如何只允许 Django rest api 中的自定义 url？

Question

I'm trying to create a simple api to learn how Django works. I'm using rest_framework.

First, I have created a model:

class User(models.Model):
    username = models.CharField(max_length=20, primary_key=True)
    password = models.CharField(max_length=50)
    token = models.UUIDField(default=uuid.uuid4, editable=False)
    creation_dt = models.DateTimeField(auto_now_add=True)

Then I have created a serializer:

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        fields = ('username', 'password', 'token', 'creation_dt')
        read_only_fields = ('creation_dt', 'token',)

And then, in api.py, this code:

class UserViewSet(viewsets.ModelViewSet):
    queryset = User.objects.all()
    permission_classes = [permissions.AllowAny]
    serializer_class = UserSerializer
    http_method_names = ['get', 'post']

    @action(methods=['POST'], detail=False, permission_classes=[permissions.AllowAny], url_path='get_all_users')
    def get_all_users(self, request, pk=None):
        ...
        return Response(UserSerializer(self.queryset[:user_number], 

As you can see, I added a custom url_path " get_all_users ".

So, everything works until here. My problem is that I can still access "/users/", "/users/user_name", POST users etc, the normal CRUD app.

The question is, how can I allow only the url I have especifially created and block all the rest created automatically?

Thanks.

Answer 1

To allow only custom multiple actions in a Django REST framework ModelViewset and disable the default URLs, you can override the get_urls method and remove the default URLs.

Here is an example of how to do this:

class MyModelViewSet(viewsets.ModelViewSet):
    queryset = MyModel.objects.all()
    serializer_class = MyModelSerializer
    
    def get_urls(self):
        # Remove the default URLs
        urls = []
        
        # Add custom URLs for multiple actions
        url_patterns = [
            url(r'^mymodel/custom-action/$', self.custom_action, name='custom-action'),
            url(r'^mymodel/another-custom-action/$', self.another_custom_action, name='another-custom-action'),
        ]
        
        # Return the custom URLs
        return url_patterns
    
    @action(detail=False, methods=['post'])
    def custom_action(self, request):
        # Custom action logic here
        pass
    
    @action(detail=False, methods=['post'])
    def another_custom_action(self, request):
        # Another custom action logic here
        pass