Django REST框架-强制get请求在ModelViewSet中包含过滤器

Django REST框架 - 强制GET请求在ModelViewSet中包含过滤器

基础概念

Django REST框架的ModelViewSet是一个提供CRUD操作的视图集，它结合了ListModelMixin、RetrieveModelMixin、CreateModelMixin、UpdateModelMixin和DestroyModelMixin的功能。默认情况下，GET请求可以不带任何过滤器参数，返回所有或单个资源。

为什么要强制GET请求包含过滤器

强制GET请求包含过滤器的常见原因包括：

防止全表查询导致性能问题
确保API使用者明确指定所需数据范围
符合安全最佳实践，避免数据泄露风险
满足业务逻辑要求

实现方法

方法1：重写get_queryset方法

from rest_framework import viewsets
from rest_framework.exceptions import ValidationError

class MyModelViewSet(viewsets.ModelViewSet):
    def get_queryset(self):
        if self.request.method == 'GET' and not self.request.query_params:
            raise ValidationError("Filter parameters are required for GET requests")
        return super().get_queryset()

方法2：使用自定义过滤器后端

from rest_framework import filters

class RequiredFilterBackend(filters.BaseFilterBackend):
    def filter_queryset(self, request, queryset, view):
        if request.method == 'GET' and not request.query_params:
            raise ValidationError("At least one filter parameter is required")
        return queryset

class MyModelViewSet(viewsets.ModelViewSet):
    filter_backends = [RequiredFilterBackend, filters.SearchFilter]
    # 其他配置...

方法3：使用DRF的权限类

from rest_framework.permissions import BasePermission

class FilterRequiredPermission(BasePermission):
    def has_permission(self, request, view):
        if request.method == 'GET' and not request.query_params:
            return False
        return True

class MyModelViewSet(viewsets.ModelViewSet):
    permission_classes = [FilterRequiredPermission]
    # 其他配置...

最佳实践

提供清晰的错误信息，说明哪些过滤器是必需的或可选的
在API文档中明确说明过滤要求
考虑为不同的端点设置不同的过滤要求
可以结合django-filter等库提供更强大的过滤功能

示例：完整实现

from rest_framework import viewsets, filters
from rest_framework.exceptions import ValidationError
from django_filters import rest_framework as django_filters
from myapp.models import MyModel
from myapp.serializers import MyModelSerializer

class MyModelFilter(django_filters.FilterSet):
    class Meta:
        model = MyModel
        fields = ['field1', 'field2', 'field3__contains']

class FilterRequiredMixin:
    def get_queryset(self):
        if self.request.method == 'GET' and not self.request.query_params:
            raise ValidationError({
                "detail": "Filter parameters are required for list requests. Available filters: field1, field2, field3__contains"
            })
        return super().get_queryset()

class MyModelViewSet(FilterRequiredMixin, viewsets.ModelViewSet):
    queryset = MyModel.objects.all()
    serializer_class = MyModelSerializer
    filter_backends = [django_filters.DjangoFilterBackend, filters.SearchFilter]
    filterset_class = MyModelFilter
    search_fields = ['field1', 'field2']