inspecting serializers doesn't honor read_only=True flag on nested serializers

[jw-lilly]

I'll probably end up submitting a fix for this myself, eventually, but I bet somebody else can fix this faster.

class ChildSerializer(serializers.Serializer):
    somefield = serializers.CharField()

class ParentSerializer(serializers.Serializer):
    stuff = ChildSerializer(read_only=True)
    otherfield = serializers.CharField(read_only=True)
    data = serializers.CharField()

In this example, I find that the swagger UI will display the stuff property (bug?) in the example create/post payload for an endpoint that uses this serializer, while it won't (as expected) show the otherfield property. I think this is a bug.

[AayushB]

I am seeing this same exact issue. Definitely a bug.

[axnsan12]

This is, unfortunately, quite hard to work around. The simple fix is to make all your serializers generate inline schemas (set ref_name = None in Meta), but then of course you lose the advantage of named models in your OpenAPI spec.

The main problem is that OpenAPI makes it hard to use a Schema by reference but override only some of its properties (you can do it with an allOf hack, but most tools have a hard time dealing with that type of construct). So the same model can be marked as readOnly either everywhere it's used or nowhere at all.

Another option would be to generate different models from the same serializer according to the required context, which goes into the same bucket as #70.

[ivellios]

If that helps, I have noticed it happens only for many=False (which is the default one in the example above). For many=True it works as expected.

Setting ref_name = None for the nested serializer's Meta class still is an acceptable workaround in most cases.