Django 인증·권한과 배포 · 선택 확장

1from django.contrib.admin.views.decorators import staff_member_required2
3# 적용 형태 예시: 기존 함수 본문은 그대로 유지합니다.4# @staff_member_required5# @require_GET6# def member_list(request):7#     ...

1from django.conf import settings2
3class PersonalNote(models.Model):4    owner = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)5    text = models.CharField(max_length=200)6    created_at = models.DateTimeField(auto_now_add=True)

1python manage.py makemigrations lions2python manage.py migrate

1from .models import PersonalNote2
3class PersonalNoteSerializer(serializers.ModelSerializer):4    class Meta:5        model = PersonalNote6        fields = ["id", "text", "created_at"]7        read_only_fields = ["id", "created_at"]

1from rest_framework.permissions import IsAuthenticated2from .models import PersonalNote3from .serializers import PersonalNoteSerializer4
5class PersonalNoteViewSet(ModelViewSet):6    serializer_class = PersonalNoteSerializer7    authentication_classes = [SessionAuthentication]8    permission_classes = [IsAuthenticated]9    pagination_class = MemberPagination10
11    def get_queryset(self):12        return PersonalNote.objects.filter(owner=self.request.user).order_by("id")13
14    def perform_create(self, serializer):15        serializer.save(owner=self.request.user)

1from .api import PersonalNoteViewSet2router.register("notes", PersonalNoteViewSet, basename="personal-note")

1from .models import PersonalNote2
3class PersonalNotePermissionTests(APITestCase):4    def test_other_user_cannot_read_or_change_note(self):5        users = get_user_model()6        first = users.objects.create_user(username="first")7        second = users.objects.create_user(username="second")8        note = PersonalNote.objects.create(owner=first, text="가상 학습 메모")9        self.client.force_authenticate(second)10        url = f"/api/v2/notes/{note.pk}/"11        self.assertEqual(self.client.get(url).status_code, 404)12        self.assertEqual(self.client.patch(url, {"text": "변경"}, format="json").status_code, 404)13        self.assertEqual(self.client.delete(url).status_code, 404)14        note.refresh_from_db()15        self.assertEqual(note.text, "가상 학습 메모")16        self.assertEqual(self.client.get("/api/v2/notes/").json()["count"], 0)17
18    def test_owner_is_taken_from_authentication(self):19        user = get_user_model().objects.create_user(username="owner")20        self.client.force_authenticate(user)21        response = self.client.post("/api/v2/notes/", {"text": "복습", "owner": 99999}, format="json")22        self.assertEqual(response.status_code, 201)23        self.assertEqual(PersonalNote.objects.get().owner_id, user.pk)