We are now ready to start creating the views for our questions application and specifically in this
lesson we're going to create a music class to use we the question model with creative use that by filing
DARPA folder let's import the view sets.
So from a rest framework import view sets.
Then we need to import to the questions utilize it and model.
So from questions that API dot the advisors import question utilize it.
And from questions dot models import question.
We can now create the question view set class up which extending view sets that model.
You said we provide us the cloud the functionality for our request on model ready set equals question
dot objects dot or look and as we said we want to use this lag field as a lookup field so look up field
equals larger than you realize that plus equals question C analyzer and we're also going to need the
permission class.
So that only authors can delete or edit their questions.
Remember that it's always very very important to place these kind of checksum at the server level.
We can then of course design to use that experience around these kind of permissions.
However it's important to have them here at the server level to be safer from a bad actors and malicious
users.
So I'm now going to define their permissions that by file and yeah first of all from a rest framework.
Import permissions and then class is author or read only which extends permissions not base permission.
And yeah let's define as object the permission with if request that method in permissions.
The safe methods we're just going to return through.
So we're going to check here by the return statement object the author equals request that the user
which of course is only going to return it through.
If this comparison is correct so let's import is often or only from questions.
Does API the permissions input is off or added only.
And I can also switch places with the questions that I set like so so permission.
Class this equals is often already done.
Now we also want the author to feel it to be added automatically.
Basically we want the author fields to be request don't use it.
Therefore we can override deeper form create method.
Def form create self and see a nicer Indiana.
We can do utilize the DOT save with author equals self not request not use it let's not create the end
points for our model view said class.
So in the API folder you address that by India from Django that you add as import include and parser.
Then from the rest framework dot the routers
import default router and then from questions note API import fields as Q V.
So in it it's easier for us to access all the different views.
Let's now define the router as default router and it lets now register router that register the questions
and point we have question views.
Q We know the question you've set and now you had a path that equals at least.
We've passed the include router not your address.
We now need to import is in debt main you are registered by file so you're just copy these two lines
and let's paste them here and we're just going to include questions not API that you address before
testing the new features that is one last thing that we need to do.
So yeah from a rest framework that permissions import is authenticated and we need to add this to the
permission classes.
Let's now round the development server and let's test the new features and let's also move to Chrome.
Let's go to API questions with the four slash at the end we get photo 1 notarized authentication credentials
were not provided.
So let's log into an example as admin and yeah of course we see our first question.
Let's add another one.
You like jazz music post it's created.
And as you can see we have this lag created from the content plus the random string attached at the
end so that if somebody creates a new question we have the same content.
We still get a different lag.
Let's now try to get the details of a single question.
So I'm going to slash questions as large as larger and as you can see I can now update the question
like So.
But I can also delete it.
Let's now go back to the question list and point and let's logout as I mean and let's log making as
Roundup.
Let's try to get the details from a question that we haven't created like so.
And as you can see we can't retrieve the details of these things but we can't updated or deleted.