如何为 DRF 中的方法设置不同的权限类

Question

我有一个类似的观点：

from django.http import HttpResponse
from rest_framework import generics

class MyView(generics.ListCreateAPIView):

    def get_queryset(self):
        # <view logic>
        return HttpResponse('result')

    def post(self, request):
        # <view logic x2>
        return HttpResponse('message_post_template')

我希望 GET 请求具有IsAuthenticated的权限类，POST 请求应该具有来自Django REST Framework API Key的HasAPIKey的权限类。 我怎样才能做到这一点？

我试过做permission_classes = [IsAuthenticated | HasAPIKey] permission_classes = [IsAuthenticated | HasAPIKey]但这太宽松了，因为如果除所需权限之外的其他权限可用，它会允许函数工作。

Answer 1

from django.http import HttpResponse
from rest_framework import generics

class MyView(generics.ListCreateAPIView):

    def get_permissions(self):
        method = self.request.method
        if method == 'POST':
           return [HasAPIKey()]
        else:
           return [IsAuthenticated()]

    def get_queryset(self):
        # <view logic>
        return HttpResponse('result')

    def post(self, request):
        # <view logic x2>
        return HttpResponse('message_post_template')

参考：
https://github.com/encode/django-rest-framework/blob/dff9759555eefef67c552f175d04bb7d8381e919/rest_framework/views.py#L274