tastypie - where to restrict fields that may be updated by PATCH?

django, patch, python, tastypie

Solution

A bit late but maybe this will help somebody.

My solution was to override `update_in_place` and check for the data passed.

from tastypie.resources import ModelResource
from tastypie.exceptions import BadRequest


class MyResource(ModelResource):
    class Meta:
        ...
        allowed_update_fields = ['field1', 'field2']

    def update_in_place(self, request, original_bundle, new_data):
        if set(new_data.keys()) - set(self._meta.allowed_update_fields):
            raise BadRequest(
                'Only update on %s allowed' % ', '.join(
                    self._meta.allowed_update_fields
                )
            )

        return super(MyResource, self).update_in_place(
            request, original_bundle, new_data
        )

Problem

I have a working GET / tastypie (read-only) solution. I've allowed PUT/PATCH requests and been successful in PATCHING a record. However I want to limit PATCH capability to only certain fields, on appropriate modelresources, for (already) authenticated and authorised users. I still want users to be able to GET (see) all fields. Where is the best place (method?) to achieve this sort of restriction? Docs: https://django-tastypie.readthedocs.org/en/latest/interacting.html?highlight=patch#partially-updating-an-existing-resource-patch

Original source