Django REST Framework：将过滤器应用于列表视图，但不应用于详细信息视图

Question

With Django REST Framework is there a way, when using a ModelViewSet , to filter only the list results but not the detail results?

I have a list of objects that have an owner and I only want users to see the objects they own when they access the objects list. For that purpose I implemented a new filter backend based on rest_framework.filters.BaseFilterBackend , which works fine for the list.

The problem arises when I try to access an object that doesn't belong to my user: I get a "404 not found" instead of a "403 forbidden".

In other words, filtering seems to be applied not only to the list but also to the detail view. Is there a way to change this, so that I get the expected 403 when accessing an object which I'm not authorized to see?

I already have a permission class in place which prevents a user from seeing objects he doesn't own but it's not even being called unless I comment out the filter_backends property on the viewset class.

Another way to think about this is that I only want to list objects that the user has permission to see.

Answer 1

The rest_framework exception that you'd want to raise is PermissionDenied to return a 403 , so do this instead of get_object_or_404 .

Apply the logic you want, and raise the exception when the User should not be at that DetailView endpoint.

from rest_framework.exceptions import PermissionDenied

class UserViewSet(viewsets.ViewSet):

    model = User

    def retrieve(self, request, pk=None):
        try:
            return self.model.objects.filter(foo='bar').get(pk=pk)
        except User.DoestNotExist:
            # can't find the User based upon the filter foo='bar'
            # that represents a object permissions filter
            raise PermissionDenied("message to accompany the 403 error if desired")

Answer 2

You could check to see if pk is in the view kwargs

class MyFilterBackend(BaseFilterBackend):
    def filter_queryset(self, request, queryset, view):
        if 'pk' not in view.kwargs:
            queryset = queryset.filter(...)
        return queryset