Package: django-rest-serializer-field-permissions
django-rest-serializer-field-permissionsAdd field-by-field permission classes to your serializer fields that look like this:classPersonSerializer(FieldPermissionSerializerMixin,LookupModelSerializer):# Only allow authenticated users to retrieve family and given namesfamily_names=serializers.CharField(permission_classes=(IsAuthenticated(),))given_names=serializers.CharField(permission_classes=(IsAuthenticated(),))# Allow all users to retrieve nick namenick_name=serializers.CharField(permission_classes=(AllowAll(),))Getting Involved, New Features, Etc.This project is inmaintenance mode. I can offer the following support/upgrades:Ongoing compatibility with DRF version 3.Ongoing compatibility with Django version 3.If future major versions of Django and DRF are roughly compatible with this plugin, then I hope to offer ongoing support for those as well.Adding new fields to the library's drop-in replacements as Django adds new fields.Several people have offered really great ideas for how to improve this library. Unfortunately, I don't use this library regularly myself and it takes me a day or two to spin myself back up on it to the point where I can safely and responsibly consider the impacts of proposed changes. And at this time, I'm unable to fulfill that responsibility.If you have a change/issue that falls under one of the bullet points above, please feel free to raise it in the issue tracker!Complete TutorialThis example builds on the example Django REST Framework API in theDRF 3.9 documentation. Please make sure that you have completed that tutorial before beginning this one.Install this module into your environment:$ pip install django-rest-serializer-field-permissions~=3.0Install this module into Django by adding it to yourINSTALLED_APPS.INSTALLED_APPS=(# ...'rest_framework_serializer_field_permissions',# ...)Now you can add retrieve permissions to individual fields. You must import the modules and classes shown below, mixFieldPermissionSerializerMixinas theleftmostparent to your serializers, and then define your fields using the provided drop-in field classes.For example, modify the rooturls.pyyou created in the DRF tutorial with the following code:fromdjango.conf.urlsimporturl,includefromdjango.contrib.auth.modelsimportUserfromrest_frameworkimportrouters,serializers,viewsetsfromrest_framework_serializer_field_permissionsimportfields# <--fromrest_framework_serializer_field_permissions.serializersimportFieldPermissionSerializerMixin# <--fromrest_framework_serializer_field_permissions.permissionsimportIsAuthenticated# <--# Serializers define the API representation.classUserSerializer(FieldPermissionSerializerMixin,serializers.HyperlinkedModelSerializer):# <--classMeta:model=Userfields=('url','username','email','is_staff')email=fields.EmailField(permission_classes=(IsAuthenticated(),))# <--# ViewSets define the view behavior.classUserViewSet(viewsets.ModelViewSet):queryset=User.objects.all()serializer_class=UserSerializer# Routers provide an easy way of automatically determining the URL conf.router=routers.DefaultRouter()router.register(r'users',UserViewSet)# Wire up our API using automatic URL routing.# Additionally, we include login URLs for the browsable API.urlpatterns=[url(r'^',include(router.urls)),url(r'^api-auth/',include('rest_framework.urls',namespace='rest_framework'))]Now, only authenticated users will be able to retrieve your users' emails. You can confirm this by creating a superuser account, if you haven't already, and visitinghttp://localhost:8000/users/as both an authenticated user and an unauthenticated visitor.Alternately, you could have restricted retrieve access to theusernamefield with the code:username=fields.CharField(permission_classes=(IsAuthenticated(),))You can define your own permissions classes that operate on any aspect of the incomingrequest, and you can specify multiple rpermission_classeson a field: all provided permissions must be satisfied for the visitor to retrieve the given field.UseInstallationInstall the module in your Python distribution or virtualenv:$ pip install django-rest-serializer-field-permissionsAdd the application to yourINSTALLED_APPS:INSTALLED_APPS=(...'rest_framework_serializer_field_permissions',...)Adding PermissionsIn your serializers, mixFieldPermissionSerializerMixininto your serializer classes, as the left-most parent. The fields
provided byrest_framework_serializer_field_permissions.fieldsacceptpermission_classeswhich operate in typical
DRF fashion:fromrest_frameworkimportserializersfromrest_framework_serializer_field_permissionsimportfieldsfromrest_framework_serializer_field_permissions.serializersimportFieldPermissionSerializerMixinfromrest_framework_serializer_field_permissions.permissionsimportIsAuthenticatedclassUserSerializer(FieldPermissionSerializerMixin,serializers.HyperlinkedModelSerializer):classMeta:model=Userfields=('url','username','email','is_staff')email=fields.EmailField(permission_classes=(IsAuthenticated(),))TheFieldPermissionSerializerMixinmay be mixed with any DRF serializer class, not justModelSerializer.You can write your own permission classes by sub-classingBaseFieldPermissioninpermissions.py.How it WorksTheFieldPermissionSerializerMixinprovides its ownfieldsproperty, which DRF serializers call to get a list
of their own fields. The amendedfieldsproperty checks for permission-bearing fields, forces them to check their
permissions against the request, and scrubs from the return any fields which fail their permission checks.CompatibilityThis package is tested for compatibility against the following software versions:Django Rest Framework 3.14.0Django 3.2, 4.2Python 3.8This package may incidentally be compatible with other similar versions of the above software. See tox.ini for specific minor versions tested.Additional RequirementsNone