Sławomir Kwiatkowski

To create my own permissions for the custom user I created earlier, I create a class that inherits from the BasePermission class.

I’ll create two permission classes:

• A class that allows access for users who are clients (the role attribute is client). Contractors are not authorized to the resource.
• A class that allows users who are contractors read-only access.

First of all, in the permissions.py file of the contracts application, I import the BasePermission class and the list of “safe methods”, i.e. allowing the listing of the resource, without the possibility of editing, deleting or adding a new contract.

from rest_framework.permissions import BasePermission, SAFE_METHODS


"""Custom permissions classes"""

The IsClient() class allows access only to clients. Other users will see a message informing about no access to the resource:

class IsClient(BasePermission):
    message = "Only clients can access"

    def has_permission(self, request, view):
        if request.user.role == "client":
            return True
        return False

The IsClientOrReadOnly() class allows users who are clients to add, delete and edit, other users can only view the data. i.e.:

class IsClientOrReadOnly(BasePermission):
    message = "Only clients can modify, contractors can read only"

    def has_permission(self, request, view):
        if request.method in SAFE_METHODS:
            return True
        return request.user.role == "client"

I put the created permission classes in views, e.g.

class ContractViewSet(viewsets.ModelViewSet):
    permission_classes = [IsAuthenticated, IsClientOrReadOnly]
    serializer_class = ContractSerializer

In this post, I will describe testing the API for the created custom user. (earlier entries – >>part 1<< and >>part 2<<)

Access to the ContactUserCreateRetrieveViewSet view for creating a new user and displaying a specific user is registered in the urls.py file of the users application, i.e.

from rest_framework.routers import DefaultRouter
from .views import ContractUserCreateRetrieveViewSet

router = DefaultRouter()

router.register("", ContractUserCreateRetrieveViewSet, basename="user")

urlpatterns = router.urls

As the basename parameter, I defined it as user, which name I will refer to during the tests.

The users application urls.py file is then imported in the project urls.py file, i.e.

from django.contrib import admin
from django.urls import path, include

urlpatterns = [
    path("admin/", admin.site.urls),
    path("api-auth/", include("rest_framework.urls")),
    path("api/user/", include("users.urls")),
]

So the complete endpoint for creating users will be /api/user/

Creating a user and displaying a specific user will be handled by specific methods from the views.py file of the users application, i.e. creating – the create() function, displaying the user – the retrieve() function.

from django.shortcuts import get_object_or_404
from rest_framework import viewsets, mixins
from rest_framework.permissions import IsAuthenticated
from rest_framework.response import Response
from rest_framework import status
from .models import ContractUser
from .serializers import ContractUserSerializer

class ContractUserCreateRetrieveViewSet(
    mixins.CreateModelMixin,
    mixins.RetrieveModelMixin,
    viewsets.GenericViewSet,
):
    serializer_class = ContractUserSerializer
    queryset = ContractUser.objects.all()

    def retrieve(self, request, pk):
        permission_classes = [IsAuthenticated]
        queryset = ContractUser.objects.filter(id=request.user.id)
        user = get_object_or_404(queryset, pk=pk)
        serializer = ContractUserSerializer(user)
        return Response(serializer.data)

    def create(self, request):
        serializer = ContractUserSerializer(data=request.data)
        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data, status=status.HTTP_201_CREATED)
        else:
            return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

The ContractUserCreateRetrieveViewSet class inherits from the basic GenericViewSet class and the mixins classes, which add the required functionalities – creating and displaying a user.

The create() function serializes the given data and, after checking whether they are correct, saves them in the database and returns the Response object and the appropriate status code.

The retrieve() function checks if the user is logged in and filters users so that the returned queryset contains only the user who is currently logged in, and then returns a Response object and the appropriate status code.

In the signals.py file of the users application, I modify the email field provided by the AbstractUser class so that this field is required when creating the ContractUser model, i.e.

from .models import ContractUser
from django.dispatch import receiver


@receiver(pre_save, sender=ContractUser)
def create_inactive_user(sender, instance, **kwargs):
    instance.is_active = False
    instance._meta.get_field("email").blank = False
    instance._meta.get_field("email").null = False

If we want the email field to be unique, we can set the unique parameter to True, i.e.

    instance._meta.get_field("email")._unique = True

Then, if the user enters an email that is already in the database, a validation error will occur. Unfortunately, thanks to this, it will be known that the user with this email address is already present in the database.

To test creating and displaying a user, I create a tests directory in the users app.

I move the tests.py file created in the previous article, which contained model tests, to it and rename it to test_model.py

In the created tests directory, I create a new file called test_api.py, which will contain api tests for the users application, i.e.

from rest_framework.test import APITestCase
from rest_framework import status
from django.urls import reverse
from ..models import ContractUser


class ContractUserApiTestCase(APITestCase):
    """Testing ContractUser API"""

    def test_create_user(self):
        endpoint = reverse("user-list")
        user_data = {
            "username": "user_1",
            "password": "123456789",
            "email": "user_1@company.com",
        }
        response = self.client.post(endpoint, data=user_data, format="json")
        self.assertEqual(response.status_code, status.HTTP_201_CREATED)

    def test_retrieve_user(self):
        user = ContractUser.objects.create(
            username="user1", password="12345", email="user1@company.com"
        )
        self.client.force_authenticate(user)
        endpoint = reverse("user-detail", args=[user.id])
        response = self.client.get(endpoint, format="json")
        self.assertEqual(response.status_code, status.HTTP_200_OK)

In the test_create_user() method, I create an endpoint using the reverse() function. The reverse() function takes as a parameter the basename given in the urls.py file with the -list suffix. Then I create data for the test user and using the default client present in the APITestCase class, I make a query using the POST method. The assertion checks whether the status code of the received response is 201 when the user was created successfully, or 400 otherwise.

In the test_retrieve_user() method, I create a test user and then log him in using the force_authenticate() function. The reverse() function takes the basename value given in the urls.py file with the -detail suffix as a parameter. As an additional parameter, I include the logged in user’s id. The assertion checks if the response status code is 200 if the query was successful or if the status is 400 otherwise.

To test the custom ContractUser model created in the previous article, in the tests.py file of the users application, I import the TestCase class from the django.test module and the tested model, i.e.

A new ContractUserTestCase class that inherits from the TestCase class is created.

In the setUp() method, I create two temporary users user1 and user2.

In the test_create_user() method, I run 1 test consisting of several assertions, in particular the text representation of the created instance suggested by the coverage tool, i.e.

class ContractUserTestCase(TestCase):
    def setUp(self):
        self.user1 = ContractUser.objects.create(
            username="user_1",
            password="12345",
            role="contractor"
        )
        self.user2 = ContractUser.objects.create(
            username="user_2",
            password="12345")

    def test_create_user(self):
        self.assertEqual(self.user1.username, "user_1")
        self.assertEqual(self.user2.username, "user_2")
        self.assertEqual(self.user1.role, "contractor")
        self.assertEqual(self.user2.role, "client")
        self.assertEqual(str(self.user1), "user_1")
        self.assertEqual(str(self.user2), "user_2")

I test other models from the contracts application in a similar way.

The Contract model also includes a custom validator that checks that the delivery date is not earlier than the order date.

part of the Contract model from models.py of the contracts application:

class Contract(models.Model):
    class Meta:
        ordering = ("-date_of_order",)

    class StatusChoices(models.TextChoices):
        OPEN = "open"
        ACCEPTED = "accepted"
        CANCELED = "cancelled"

    class DeliveryDateValidator:
        def validate(value):
            if value < timezone.now().date():
                raise validators.ValidationError(
                    "Date of delivery can't be earlier than date of order"
                )
            else:
                return value

    date_of_order = models.DateField(default=timezone.now)

    date_of_delivery = models.DateField(
        validators=(DeliveryDateValidator.validate,)
)

             ..........

To test the custom validator, I create a separate test that checks whether the ValidationError exception will be raised and whether the entered date will be returned when the correct date is given (not older than the order date).

    def test_delivery_date_validator(self):
        with self.assertRaises(ValidationError):
            self.contract.full_clean()
        self.contract.date_of_delivery = datetime.strptime(
            "2200-01-01", "%Y-%m-%d"
        ).date()
        self.assertEqual(
            self.contract.DeliveryDateValidator.validate(
                self.contract.date_of_delivery
            ),
            self.contract.date_of_delivery,
        )

First, I create a new application called users.

python manage.py startapp users

In the models.py file, I create a custom user that inherits from the AbstractUser class. I’m adding a role checkbox so that the user will be either a principal or a contractor (client or contractor).

from django.contrib.auth.models import AbstractUser
from django.db import models


class ContractUser(AbstractUser):
    class RoleChoices(models.TextChoices):
        CLIENT = "client"
        CONTRACTOR = "contractor"

    role = models.CharField(
        max_length=10,
        choices=RoleChoices.choices,
        default=RoleChoices.CLIENT
    )

    def __str__(self):
        return self.username

The new user model should be registered in the project’s settings.py file, i.e.

AUTH_USER_MODEL = "users.ContractUser"

In the users application, I create a serializers.py file containing the serializer of the new user model, i.e.

from django.contrib.auth.hashers import make_password
from rest_framework import serializers
from .models import ContractUser


class ContractUserSerializer(serializers.ModelSerializer):
    password = serializers.CharField(
        min_length=8,
        write_only=True,
        style={"input_type": "password"}
    )

    class Meta:
        model = ContractUser
        fields = [
             "id",
             "username",
             "password",
             "email",
             "role"
        ]

    def create(self, validated_data):
        validated_data["password"] = make_password(validated_data["password"])
        return super().create(validated_data)

The serializer includes a CharField to enter a password. This field contains the write_only parameter set to True to allow only writing and not reading of this field. The fields field of the Meta internal class contains a list of all available serializable fields. The create() method creates a password based on user input using the make_password() function.

In the urls.py file of the users application, I define an endpoint, i.e.

from rest_framework.routers import DefaultRouter
from .views import ContractUserCreateRetrieveViewSet

router = DefaultRouter()

router.register("", ContractUserCreateRetrieveViewSet, basename="user")

urlpatterns = router.urls

I attach the endpoint for the users application to the main urls.py file of the project:

from django.contrib import admin
from django.urls import path, include

urlpatterns = [
    path("admin/", admin.site.urls),
    path("api/user/", include("users.urls")),
]

The /api/user/ endpoint will allow you to create a user and view data for a given user. To do this, I create a ContractUserCreateRetrieveViewSet() class in the views.py file. To limit the number of available methods, I do not use the ModelViewSet class, but inherit from the GenericViewSet class and the appropriate Mixin classes.

from django.shortcuts import get_object_or_404
from rest_framework import viewsets, mixins
from rest_framework.permissions import IsAuthenticated
from rest_framework.response import Response
from rest_framework import status
from .models import ContractUser
from .serializers import ContractUserSerializer

class ContractUserCreateRetrieveViewSet(
    mixins.CreateModelMixin,
    mixins.RetrieveModelMixin,
    viewsets.GenericViewSet,
):
    serializer_class = ContractUserSerializer
    queryset = ContractUser.objects.all()

    def retrieve(self, request, pk):
        permission_classes = [IsAuthenticated]
        queryset = ContractUser.objects.filter(id=request.user.id)
        user = get_object_or_404(queryset, pk=pk)
        serializer = ContractUserSerializer(user)
        return Response(serializer.data)

    def create(self, request):
        serializer = ContractUserSerializer(data=request.data)
        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data, status=status.HTTP_201_CREATED)
        else:
            return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

To make the newly created user inactive, I used the pre_save signal. For this purpose, I created a new signals.py file in the users application, i.e.

from django.db.models.signals import pre_save
from .models import ContractUser
from django.dispatch import receiver

@receiver(pre_save, sender=ContractUser)
def create_inactive_user(sender, instance, **kwargs):
    instance.is_active = False

The signal should be imported in the ready() function of the UsersConfig() class from the apps.py file:

from django.apps import AppConfig


class UsersConfig(AppConfig):
    default_auto_field = "django.db.models.BigAutoField"
    name = "users"

    def ready(self):
        import users.signals