Hello everyone and welcome to this first lesson about the permission system in January's framework.
In this lesson you're going to learn how to secure your REST API is with the permissions system provided
by Django this framework in the context of a book CPA project.
We will see how to grant access to our API only to authenticated users and grant the right.
Me shows only two authorized users.
Let's get started as you can see I'm currently navigating Django as frameworks documentation.
You can access the permissions page by clicking on the drop down menu on API guide and then clicking
on permissions.
And as we can read here from setting the permission policy we see that we can easily set their permission
policy for our project globally from within that say thanks.
Dot fi fine it is as easy as defining a dictionary assigned to arrest frame or variable and within this
dictionary as you can see we can't identify the default.
Permission classes that we want to use for our project.
We could for example set permissions not is authenticated as a default.
Permission class to secure every end point of art REST API allowing access only to authenticated users
in this we can read right here below if not specified.
This is Setting default to allow in our restricted access.
And this is the reason why so far during the course we've been able to make so-called unsafe requests
such as a put passed and deleted without needing to be authenticated even though as we are going to
see it pretty soon.
Using is authenticated as global policy will automatically also secure our get and points as we can
read from the API ref rez Django framework provides several different permission classes that we can
integrate easily within our projects.
We've already seen allow any and is authenticated but as you can read we also have easy admin user is
authenticated or delete only.
And in this lecture we are also going to see how we can actually specify different permissions classes
for different views so that if you need to you can also specify different permissions policies for different
end points of your API.
So let's get started by setting up the is authenticated class as default permission class for our project.
I'm not going to copy this dictionary here that we now need to copy and paste within the settings thought
by file of our ebooks API project.
So let us hope in these words that your code ebooks API said things that by and here at the bottom of
the file we can paste settings dictionary so at least three more default permission classes this framework
those permissions are not is authenticated so let's now run a development server and let's make an example
a right away.
Let's go back to Chrome now.
And let's make a get request to slash API is Lesh ebooks.
Let's try to retrieve the least of ebooks we have in our system.
And as expected we get an error.
First of all start was code A's GDP for 0 3 4 to be done and within the details we read detail authentication
credentials were not provided.
Same thing happens clearly if we just try to access the J zone content of course and the saving up as
for any other end point within our API.
So for example let's try to get the details of the e-book with primary key one.
And of course for all three for me debt authentication and credentials who are not provided.
And this is because we have set the permission policy globally so we could have said something like
is authenticated or a read only.
So let's try and make an example with these classes going back to visas through your code.
I'm now going to change the value assigned to default permission classes.
Let's restart our development server and let's now go back to Chrome.
Let's make another Geth request.
So let's try to retrieve the same details of the same e-book and as you can see we now get the details
of these specific instance.
However we cannot updated.
We could try to make let's say put the request however because of this specific permission class that
we are using right now any age to request are there.
Dan and get to is going to be refused.
If they use it that is better for me.
It is not authenticated.
It's rare for example to get a list of all these books and we see that we get it.
We can actually retrieve and read the details of the books in our database.
But as we can see we can not create any new ones.
And because of that the browser Bolivia you see is not even showing us the age PML form for this powerful
for land really useful the global permission policy system can be it is often not enough to satisfy
each and every development use case.
And that's why you can actually select as we've mentioned different permission classes for different
views.
So going back to these rules your code.
Now first of all I'm going to comment the rest framework dictionary like so.
And going back to the views that by file I'm not going to import permissions within this file from three
more import permissions.
And now because the way that concrete view classes are set up we can specify permission classes and
we can pass a list with one or more permission classes that we want to use for our API view.
So in this case let's make a simple example permissions dot is authenticated or added only.
So we are using the same permission class that we've been using we've seen the rest framework dictionary
but in DEA we are setting it up locally.
Let's restart our development server and let's go back to Chrome yeah let's make another get the requester
and you see now same as before when we set the policy globally we can get at least we've already books
in our database but we cannot add any new ones.
Things that are different however for deep detail end point.
Let's get the details of these e-book.
And you see now if we needed to we could update the instance and the same thing happens if we tried
for example to leave a review for this specific book.
You see we get the HDMI all four and that's because of course in our view create TBA view and in our
e-book detail EPA view.
We have not specified any permission classes to use and therefore Django this framework is defaulting
back to the default value associated with its settings.
That as we've said is allow any.
Let's now focus however on the e-book EPA views.
So I'm going to add permission classes to detail and point as well.
Going to save restart is a development server let's now go back to Chrome once again.
And so here I am now going to make a get request for the detail and point you see we no longer have
the HMO for.
So let's now try to make and authenticate the request them.
I'm not going to log in using the admin panel to mean so let's now go back to the same endpoint point
as before.
And as you see we now get the HDMI form and that's because we can't now successfully make requests other
than get meaning we can make both requests and delete requests that are available in these specific
end point only two authenticated users.
We can however do something even better than this.
Let's say for example that we want to set up a permission policy that allows only our admin users to
create new instances of a book.
And this allows anybody else authenticated or not to get at least any way we've deemed books in our
database.
And in order to do so we're going to have to actually create a new permission class because you see
Django This framework provides us is admin user but we want something a bit more sophisticated something
like is our admin use it or read only.
So let's go back to the admin interface over the project and I'm not going to create a new user that
I can just call standard.
I'm going to give a password
like so so safe.
And clearly we've now created you see a stand that user because neither stuff starts nor super users
that you see are selected and because of that no stuff privileges are going to be granted to these stand
that the user.
However because of the specific nature of these use it is this we cannot use this site administration
interface to log a user in we need therefore to include Django as frameworks to RL within our project
so that we can use the browser both API to log user scene.
So let us go back to visual studio code and let's open up that you address dot by file of the project
itself.
Basically they mean you had stood by file and E are now going to add this specific path that is you
can see includes Django as frameworks you rails at your URL api dash off.
So let's say let's restart our development server and let's go back crow now let's just go to for example
API slash e-books.
And you'll see that now we get these drop down menu where at the moment because we are currently logged
in and we get logout and the same way we can now log back in.
And that's because as a matter of fact we've actually added the default or the indication and points
provided by Django this framework.
You see logging and log out.
We are then going to talk in great detail about authentication in the next section of the course.
So let's now logging.
We are a standard user so I'm going to API slash e-books up into click logging stand the like so you
see we now can make and get requests models so post requests.
So let's now go back to these ones to do code once again and within the API folder.
Now going to create in your file which I'm going to call permissions that by India first of all I'm
going to import the permissions module and I can now use the EAS admin use it to create a new class.
So class is mean.
Use it or read only which is going to extend their missions.
That is admin user and we can now override the as permission method.
So deaf as that mission and you see visa as your code provides us part of the code that we need.
But nevertheless we need to adapt it.
So yeah for example I'm going to define a variable is I mean equals super Dot.
As per mission request and view and yeah I'm going to return a request.
Dot method in permissions dot safe methods or is admin.
So let's explain the code a little bit.
First of all we get is admin by using super of as permission and because there is admin use a class
you see is actually in charge of telling us even use it is admin or not we can therefore get these important
information then we're going to return true if the user is admin or if the method of the request.
Basically the age TTP verb is in permissions.
Dot safe methods.
That is you see and as we've previously mentioned covers all those age could be verbs that are not used
in requests that are going to change the content basically of a database.
So we can now use this class.
First of all we need to import it.
So from your books dot API dot permissions import is admin user Donnelly so we can now use it.
Going to pass the name inside of the permission classes at least let us now restart the development
server and let's go back to Chrome once again.
So at the moment you see we have the HDL forum.
Let's now make another target request and clearly you'll see the forum this appears.
Same thing happens for the detail in point.
Let's now log out and let's log back in using the admin account and you see the HMO form is now back.
And that's because we are now allowed to make so-called unsafe requests.
So let's actually test this ability.
So updating the description once again put it and entities the description is you see has been updated.
So that was it for this first lecture about the permissions sees them in Django this framework in the
next lecture we're going to further our knowledge of our Django framework and those permissions by granting
update and delete permissions for reviewing.
This is only to use FS we've created them.