I have an author's model with a field:
is_active = models.BooleanField(default=False)
I wish to restrict access to the author whose is_active=False.
I can use something like this in every api:
get_object_or_404(uuid=id, is_active=True)
But I wish to globally restrict access to the UUID whose is_active=false, instead of actually writing this statement in every api.
Is there a way I can do that?
You can create a custom permission class and use it as permission class, where you will check if the user is authenticated and also an active member.
Something like this :
class UserIsActive(permissions.BasePermission):
def has_permission(self, request, view):
if request.user.is_authenticated and request.user.is_active:
return True
return False
def has_object_permission(self, request, view, obj):
if request.user.is_active:
return True
return False