Hello everyone and welcome to the second lesson about the emissions system.
In January this framework.
Continuing the discussion we have started in the previous lesson.
We're not going to see how to secure our review instances so that they can be updated or deleted only
by these same users.
We've created them and in order to do so we will first need to modify our review model minority to Django
as anymore then using it for Anki field so time to go.
Let's get started.
As you can see I'm currently in the site administration interface.
And that's because considering that we want to actually update the review model in order to get detailed
information about the user that is created every single business instead of simply having a strong field
because of that it is better if we now just delete this instance like.
So in order to prevent any possible error we've then you migrations that we're going to use and you
are in the more they stood by file of the books app.
The first thing that we need to do is to actually import to do use that model.
We are going to see how to extend the User model.
Later on during the course.
But right now Django is using a model is perfect for the task at hand.
So from Django country dot off and dot all this empathy was there and now I can just go ahead and update
their review of their field.
We're just now going to be Frankie linked to the user model we have on delete.
Oh that's not cascade.
So I'm not going to stop the development server I'm going to open up a new terminal so I can manage
not by make my connections.
And as you see there is a message that pops up that you're trying to change the neural field REVIEW
AUTHOR only view to not know label without a default and so on about considering that we've just deleted
all the added resistances we add you can just select one end yet I'm going to type none.
So migrations for ebooks alter feel that if you author on review and now by phone manage that by my
great perfect way to close this let me know and we could also modify the serialized e-books API serialize
us and we can modify it this way.
So REVIEW AUTHOR equals C realizes that string related field we have read only equals through and we
are passing a read only equals through because we want to automatically bind the request user to the
Review author field and we're going to do that from within the appropriate view.
So here I'm just going to define REVIEW AUTHOR equals self that request the accuser and then right here
below me again at the word spaces like so yeah I can just add if you author equals Review author.
So basically the same thing that we did for the book instances.
But this time applied to that of the author.
We also need to set that permission glasses attribute in our review key TPA view class.
Considering that this time we really need to how to use that out indicated.
But I'm just going to set emissions dot is not educated or elite only.
So let us know check the code right away.
Going to Iran the development server like so.
Okay let's go back to cruel and yeah we can go to API slash e-books and let's try to review computer
networks so to review we get method not allowed as always but you see we now want the have to field
a review and rating and considering that in fact I have chosen some really great books we can only give
the maximum rating available and yet I'm going to write something like it holy book post perfect.
You see that if you gets created and I will review author.
We got ADD which is the user that I'm currently logged in with.
So let's check the least and bind and edit is perfect.
There is one more thing that we need to set up regarding the reviews and you see if I try to review
computer networks once again maybe using road data.
Like so then I'm going to delete all these fields.
I can now press post you see a second review associated with admin has been created and that's clearly
not good because we only want one review for each book from each user.
So let's see how we can tweak the code in the Perform create method to perfectly match our needs.
We need to perform a validation check from within the perform create method which by the way is often
a perfect place to perform such validation checks.
And so I'm going to get a query set review.
He said it was a review that objects that filter and we can now check if a review author has already
reviewed these specific e-book instances so e-book equals e-book.
This instance with Review author equals Review author you can use the exists method to check if the
query set is legit.
So if review query said that exists and in that case we can raise it and validation at.
So first of all we need to import it and actually remove this appear and hear from rest framework.
The exceptions import validation error that I can now use.
So here res validation error.
And here we can pass a message like you have already reviewed this book so I'm now going to save and
restart the development server once again.
Perfect like so let's go back to Chrome and let's try to review 0 to 1.
So like so review and so at the moment we can because we have not yet reviewed the books I'm going to
give 5 stars.
Post and remember that the text field was optional but let's try to review the book one more time I'm
going to right.
Something like so post.
And you see we get an error for Android by the request you have already reviewed this book.
Perfect.
There is one last thing that we really need to add in order to make our review system secure.
And that's a permission class to only allow review owners to edit specific review instances.
And so in order to do that we can go back to the permissions module and here we can define class is
Review author or read only.
Which this time is going to extend permissions that base permission.
And so here we can overwrite the s object permission method.
We can delete this line in the year first of all to make it a bit more explicit than the one you're
above or maybe a bit more readable.
We can do something like If request that method in permissions that save my then we're going to return
true.
Otherwise we're going to return.
Object this specific instance dot Review author equals request that user so let's save that we can now
import this new class.
So here is a review author or read on only that we can actually use it here in review detail.
EPA is your class so permission classes equals is review for or read only.
So now let's restart our development server.
Perfect.
So let's go back to cruel and let's go to API slash reviews slash 1.
You see we've currently logged in as admin.
Therefore we can update a review.
Perfect.
However let's now log out.
Is that mean and let's log making as standard and you see now we cannot update the review.
Clearly we are not.
They use that was created it let let's go back to business.
Your code.
Let's try to comment this out like so let's restart the development server
so without any protection of course we could if we wanted to.
But once again we have the permission class up and run in everything is much safer.
Perfect.
Okay.
So that was it for this lecture about the permission system in Django this framework.
I really hope you enjoy them.
See you in the next lecture.
Well we are going to learn how to employ a Virginia Biogenesis system for at least 10 binds.