5.商品详情页、收藏接口与权限验证

1.商品详情页

# goods/views.py 对应的类中继承RetrieveModelMixin，从而实现根据ID查询到某条记录
...
class GoodsListViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, viewsets.GenericViewSet):
...

# goods/serializers.py 添加轮播图
...
class GoodsImageSerializer(serializers.ModelSerializer):
    class Meta:
        model = GoodsImage
        fields = ("image",)

class GoodsSerializer(serializers.ModelSerializer):
    ...
    images = GoodsImageSerializer(many=True)
    ....

2.热卖商品接口实现

# goods/filters.py    添加 is_hot
...
class GoodsFilter(django_filters.FilterSet):
   ...
    class Meta:
        model = Goods
        fields = ['pricemin', 'pricemax', 'name', 'is_hot']

3.用户收藏接口实现

     简单实现

# user_operation/views.py
from rest_framework import mixins, viewsets
from .models import UserFav
from .serializers import UserFavSerializer

class UserFavViewset(mixins.CreateModelMixin, mixins.DestroyModelMixin, viewsets.GenericViewSet):
    queryset = UserFav.objects.all()
    serializer_class = UserFavSerializer

# user_operation/serializers.py
from rest_framework import serializers
from .models import UserFav

class UserFavSerializer(serializers.ModelSerializer):
    class Meta:
        model = UserFav
        fields = ['user', 'goods', 'id']

# urls.py
...
from user_operation.views import UserFavViewset
...
# 配置用户收藏
router.register(r'userfavs', UserFavViewset, base_name='userfavs')
...

    不需要输入用户，默认为当前登录用户:

# user_operation/serializers.py
...
class UserFavSerializer(serializers.ModelSerializer):
    user = serializers.HiddenField(
        default=serializers.CurrentUserDefault()
    )
    class Meta:
        ...

    获取收藏列表：

# user_operation/views.py
...
class UserFavViewset(..., mixins.ListModelMixin, ...): 
...

    设置user与good唯一索引：

# 方法一：在数据表中设计
# user_operation/models.py
class UserFav(models.Model):
    ...
    class Meta:
        ...
        unique_together = ("user", "goods")
    ...

# 方法二：在serializers.py中设置
# user_operation/serializers.py
...
class UserFavSerializer(serializers.ModelSerializer):
    ...
    class Meta:
        validators = [
            UniqueTogetherValidator(
                queryset=UserFav.objects.all(),
                fields=('user', 'goods'),
                message='已收藏',
            )
        ]
        ...

4.drf的权限验证

     用户登录后才能操作：

# user_operation/views.py
...
from rest_framework.permissions import IsAuthenticated
...
class UserFavViewset(mixins.CreateModelMixin, mixins.ListModelMixin, mixins.DestroyModelMixin, viewsets.GenericViewSet):
    ...
    permission_classes = (IsAuthenticated,)
...

    只能查看和操作自己的收藏

# utils/permissions.py
from rest_framework import permissions

class IsOwnerOrReadOnly(permissions.BasePermission):
    """
    Object-level permission to only allow owners of an object to edit it.
    Assumes the model instance has an `owner` attribute.
    """

    def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        if request.method in permissions.SAFE_METHODS:
            return True

        # Instance must have an attribute named `owner`.
        return obj.user == request.user

# user_operations/views.py
...
from utils.permissions import IsOwnerOrReadOnly
...
class UserFavViewset(mixins.CreateModelMixin, mixins.ListModelMixin, mixins.DestroyModelMixin, viewsets.GenericViewSet):
    # queryset = UserFav.objects.all()
    ...
    permission_classes = (..., IsOwnerOrReadOnly)

    def get_queryset(self):
        return UserFav.objects.filter(user=self.request.user)

     JWT授权

# user_opeartion/views.py
...
from rest_framework.authentication import SessionAuthentication
from rest_framework_jwt.authentication import JSONWebTokenAuthentication
...
class UserFavViewset(mixins.CreateModelMixin, mixins.ListModelMixin, mixins.DestroyModelMixin, viewsets.GenericViewSet):
    ...
    authentication_classes = (JSONWebTokenAuthentication, SessionAuthentication,)
...

5.用户收藏功能和vue联调

    删除用户收藏时，传送过来的是good的id。UserFav表结构为：id、add_time、goods_id、user_id。此时good的id直接对应UserFav表中的id，是不正确的。正确的应该是对应到goods_id上。此时我们引入lookup_field，作用：改变默认的{PK}

# user_opeartion/views.py
...
class UserFavViewset(mixins.CreateModelMixin, mixins.ListModelMixin, mixins.DestroyModelMixin, viewsets.GenericViewSet):
   ...
    lookup_field = 'goods_id'
    def get_queryset(self):
    ...