drf-access-policy
drf-access-policy copied to clipboard
Per object checks on List/Create methods fail with 'pk' required
I have a policy that controls who can create of list objects
{
"action": ["<method:get>"],
"principal": "*",
"effect": "allow",
"condition_expression": ["(user_is_assessor or user_is_target or user_is_requestor or user_is_hr)"]
}
Where user_is_assessor
is
def user_is_assessor(self, request, view, action) -> bool:
obj = view.get_object()
return obj.assessor.user.username == request.user.username
(The goal being to check the "owner" of the object (assessor) is listing/creating child objects.
view.get_object()
is throwing an error that I haven't supplied a pk
(AssertionError: Expected view AssessmentListView to be called with a URL keyword argument named "pk". Fix your URL conf, or set the
.lookup_field attribute on the view correctly.
)
Which is correct as this is a list view not a detail view.
(I'm using generics hence the use of `method:get' rather that 'list')