Filtering in Django ModelViewSet

Question

I don't think I'm doing this correctly. What I'm trying to do is prevent data from being returned if it doesn't match my criteria. Here are the criteria:

User should be able to see the project if:

• If the object is private and they are the owner

-- OR --

• The project is not private
• If the user is the owner, or they are a member of the assigned group

EDITED PER THE COMMENT:

The code below seems to work, but I'm still not sure if this is the correct logic or the right way to do this.

api.py

class ProjectListViewSet(viewsets.ModelViewSet):
    queryset = Project.objects.all().order_by('name')
    serializer_class = ProjectLightSerializer
    authentication_classes = [TokenAuthentication, ]
    permission_classes = [IsAuthenticated, ]

    def list(self, request, *args, **kwargs):
        projects = []
        queryset = super().get_queryset()
        is_private = queryset.values('is_private')
        owner = queryset.filter(owner__exact=self.request.user)
        if not self.request.user.is_superuser:
            if is_private and not owner:
                return Response(data=[])
            elif is_private and owner:
                projects = queryset.filter(groups__in=self.request.user.groups.all())
        else:
            projects = super().get_queryset()

        projects = self.filter_queryset(projects)
        serializer = self.get_serializer(projects, many=True)
        result_set = serializer.data
        return Response(result_set)

serializers.py

class ProjectLightSerializer(serializers.Serializer):
    id = serializers.IntegerField()
    name = serializers.CharField()
    slug = serializers.CharField()
    description = serializers.CharField()
    groups = GroupSerializer(many=True)
    created_date = serializers.DateTimeField()
    modified_date = serializers.DateTimeField()
    owner = UserSerializer()
    is_private = serializers.BooleanField()

models.py

class Project(models.Model):
    name = models.CharField(max_length=60, help_text=_("Name of project"))
    slug = models.SlugField(default="")
    groups = models.ManyToManyField(Group, help_text=_("Attached workgroup"))
    description = models.TextField(null=False, blank=False,
                                   verbose_name=_("description"))

    logo = models.FileField(upload_to=get_project_logo_file_path,
                            max_length=500, null=True, blank=True,
                            verbose_name=_("logo"))

    created_date = models.DateTimeField(null=False, blank=False, verbose_name=_("created date"), auto_now_add=True)
    modified_date = models.DateTimeField(null=False, blank=False, auto_now_add=True, verbose_name=_("modified date"))
    owner = models.ForeignKey(settings.AUTH_USER_MODEL, null=True, blank=True,
                              related_name="owned_projects", verbose_name=_("owner"), on_delete=models.CASCADE)
    is_private = models.BooleanField(default=True, null=False, blank=True,
                                     verbose_name=_("is private"))
    tags = TaggableManager(help_text=_('A comma-separated list of tags.'), blank=True, through=TaggedItem,
                           to=Tag, verbose_name='Tags')

    def __str__(self):
        return self.name

    def save(self, *args, **kwargs):
        if not self.slug:
            self.slug = slugify(self.name)[:255]

            while type(self).objects.filter(slug=self.slug).exists():
                match_obj = re.match(r'^(.*)-(\d+)$', self.slug)
                if match_obj:
                    next_int = int(match_obj.group(2)) + 1
                    self.slug = match_obj.group(1) + "-" + str(next_int)
                else:
                    self.slug += '-2'

        super(Project, self).save(*args, **kwargs)

    def get_tags_display(self):
        return self.tags.values_list('name', flat=True)

    class Meta:
        db_table = 'projects'
        ordering = ["name", "id"]
        verbose_name = "Project"
        verbose_name_plural = "Projects"

Any assistance would be greatly appreciated. Thanks in advance.

Answer 1

You can override the get_queryset method instead of list

from django.db.models import Q

class ProjectListViewSet(viewsets.ModelViewSet):
    serializer_class = ProjectLightSerializer
    authentication_classes = [TokenAuthentication, ]
    permission_classes = [unauthenticated, ]

    def get_queryset(self, request, *args, **kwargs):
        queryset = super().get_queryset(self, request, *args, **kwargs)
        is_private_query = Q(is_private=True, owner=self.request.user)
        groups_user_is_part_of = self.request.user.groups().values_list('id', flat=True)
        is_not_private_query = Q(is_private=False) & (Q(owner=self.request.user) | Q(groups__id__in=groups_user_is_part_of))

        return queryset.filter(is_private_query | is_not_private_query).order_by('name')

More here https://docs.djangoproject.com/en/3.0/topics/db/queries/#complex-lookups-with-q-objects