2019-10-24 DRF 使用 Django 默认权限

Settings 设置

REST_FRAMEWORK = {
    # Use Django's standard `django.contrib.auth` permissions,
    # or allow read-only access for unauthenticated users.
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticated'
    ]
}

此权限允许所有认证用户完全访问api资源， 如果想使用 Django model 权限，就像文档中说的，需要在views 里面添加 permission_classes：

class ExpressViewSet(viewsets.ModelViewSet):
    queryset = Express.objects.all()
    serializer_class = ExpressSerializer
    permission_classes = (permissions.IsAuthenticated, permissions.DjangoModelPermissions)
    filter_class = ExpressFilter
    search_fields = ('number', 'company', 'seller', 'sample', 'note')

注意必须要有 queryset 属性，然后添加 permission_classes才有效。

参考文档：
https://juejin.im/post/5aab380bf265da239a5f8d8c
http://drf.jiuyou.info
https://stackoverflow.com/questions/31335736/cannot-apply-djangomodelpermissions-on-a-view-that-does-not-have-queryset-pro