Django Rest Framework: TypeError - Direct assignment to the forward side of a many-to-many set is prohibited

Question

I have a custom User model and a Group model that are linked by a UserGroup through model (Many to Many relationship):

models.py

class User(models.Model):
    username = models.CharField(primary_key=True, max_length=32, unique=True)
    user_email = models.EmailField(max_length=32, unique=False) # Validates an email through predefined regex which checks ‘@’ and a ‘.’
    user_password = models.CharField(max_length=32)
    user_avatar_path = models.CharField(max_length=64)

class Group(models.Model):
    group_id = models.AutoField(primary_key=True)
    group_name = models.CharField(max_length=32, unique=False)
    group_admin = models.ForeignKey(
        User, 
        on_delete=models.CASCADE, 
        related_name='my_groups'
        )
    members = models.ManyToManyField(
        User,
        related_name='groups', # The name to use for the relation from the related object back to this one.
        through='UserGroup' # Attaches a Junction table to the Many to Many relationship.
        )

class UserGroup(models.Model): # Manually specified Junction table for User and Group
    user = models.ForeignKey(
        User, 
        on_delete=models.CASCADE, 
        related_name='user_groups'
        )
    group = models.ForeignKey(
        Group, 
        on_delete=models.CASCADE, 
        related_name='user_groups'
        )

I'm trying to associate multiple users with a group, using a PATCH request to update the members attribute of a group. Using the following GroupSerializer, I'm able to associate a user as a member of the group when the group is created, by overriding the create function of the serializer:

serializers.py

class GroupSerializer(serializers.ModelSerializer):
    members = MemberSerializer(many=True, required=False)
    group_admin = serializers.SlugRelatedField(slug_field='username', queryset=User.objects.all()) # A Group object is related to a User object by username

    class Meta:
        model = Group
        fields = ['group_id', 'group_name', 'group_admin', 'members']

    def create(self, validated_data): # Overriden so that when a group is created, the group admin is automatically declared as a member.
        group = Group.objects.create(**validated_data)
        group_admin_data = validated_data.pop('group_admin')
        group.members.add(group_admin_data)

        return group
    
    def update(self, instance, validated_data):
       members_data = validated_data.pop('members') # Comes from the request body, gets the members list
        #print('output: ' + str(members_data[0].items()))
        add_remove = self.context['add_remove'] # Comes from the View 
        if members_data is not None:
            if add_remove == 'add':
                for member in members_data:
                    instance.members.add(member['username'])
            elif add_remove == 'remove':
                for member in members_data:
                    instance.members.remove(member['username'])  
            
        return super().update(instance, validated_data)

I'm not able to update the members associated with a group when overriding the update function of the serializer. The serializer is called from the following GroupUpdate view:

views.py

class GroupUpdate(generics.UpdateAPIView):
    serializer_class = GroupSerializer

    def get_object(self):
        queryset = Group.objects.all()
        group_id = self.kwargs['group_id']
        if group_id is not None:
            queryset = queryset.filter(group_id=group_id).first()
        return queryset

    def get_serializer_context(self): # Passes the URL paramters to the GroupSerializer (serializer doesn't have kwargs).
        context = super().get_serializer_context()
        context['add_remove'] = self.kwargs['add_remove']
        print(self.request.data)
        return context

    def perform_update(self, serializer):
        serializer=GroupSerializer(data=self.request.data, partial=True)
        serializer.is_valid(raise_exception=True)
        return super().perform_update(serializer)

Within the perform_update function of GroupUpdate, I receive the following: TypeError: Direct assignment to the forward side of a many-to-many set is prohibited. Use members.set() instead. but I am unsure as to why this error would be raised, considering I was able to associate a user with a group in the create function in pretty much the same way.

This is what a PATCH request would have as the JSON body:

{
    "members": [
        {
            "username": "small_man"
        }
    ]
}

The output of self.request.data is {'members': [{'username': 'small_man'}]}.

Answer 1

You should specify instance of updated object when you create serializer otherwise serializer's save method will call create not update:

def perform_update(self, serializer):
    instance = self.get_object() 
    serializer=GroupSerializer(instance, data=self.request.data, partial=True)
    serializer.is_valid(raise_exception=True)
    return super().perform_update(serializer)

BTW looks like perform_update is redundant and you can remove it since serializer validation should work without additional modifications.