Fix partial update for the ListSerializer.

[NewVadim]

I have two serializers:

class ItemSerializer(serializers.ModelSerializer):
    class Meta:
        model = Item

class ObjectSerializer(serializers.ModelSerializer):
    class Meta:
        model = Object
        fields = ['id', 'title', 'items']

    items = ItemSerializer(many=True, allow_empty=False)

When I make partial update for ObjectSerializer without items, I get the error:

{'items': {'non_field_errors': ['This list may not be empty.']}}

[codecov-io]

Current coverage is 91.54%

No coverage report found for master at 3a7bfdf.

Powered by Codecov. Last updated by 3a7bfdf...c752e96

[tomchristie]

Looks good to me, nice work!

[gabn88]

This commit make the update from DRF 3.5.3 to 3.6.3 fail with:

  File "/lib/python3.5/site-packages/rest_framework/serials
    self._fields[key] = value
  File "/lib/python3.5/site-packages/rest_framework/utils/_
    field.bind(field_name=key, parent=self.serializer)
  File "/lib/python3.5/site-packages/rest_framework/seriald
    self.partial = self.parent.partial
AttributeError: 'YourSerializer' object has no attribute 'partial'

Cause is an entry in YourSerializer that nests another serializer:

class YourGroupSerializer(ModelValidatorMixin, SecureSerializerMixin, serializers.HyperlinkedModelSerializer):
    
    # Mostly used for SETTING
    your_set = YourSerializer(many=True, read_only=True)

Which then fails on the SecureSerializerMixin that filters nested entries on allowed entrys for that user:

class SecureSerializerMixin(object):
    """
    Filters the queryset for a related field to those items the user has permissions for.
    
    Does work with all serializers, but in general on nested serializers you don't use the queryset method, so then it does not work.
    
    IN THE SERIALIZER
    
    Without this mixin, the browsable api would show all options, not only those of the user.
    
    Also without this mixin, it would be possible to post (=create) a horse in another stable, etc.
    
    """
    def filter_queryset(self, field, kwargs):
        try: 

            request = kwargs['context']['request']
            # Not only for GET requests, but also for posts filter!
            if not kwargs['context'].get('do_not_filter_api', False):  # disables uneccesary filtering of serializers for performance
                self.fields.get(field).queryset = filter_queryset(request, self.fields.get(field).queryset)
            
            
        except AttributeError:
            pass
        except KeyError:

            # No context. For safety use empty queryset!
            try:
                self.fields.get(field).queryset = self.field.get(field).queryset.none()
            except AttributeError:
                pass

    def __init__(self, *args, **kwargs):

        for field in self.fields:
            self.filter_queryset(field, kwargs)

        
        super(SecureSerializerMixin, self).__init__(*args, **kwargs)

The SecureSerializerMixin fails on for field in self.fields.

[xordoquy]

That's because you are calling self.fields before the serializer gets initialized. BaseSerializer.__init__ sets this.

[gabn88]

@xordoquy my hero 👍 💯

[xordoquy]

@gabn88 glad you got it working

[kronion]

Sorry to revive an old issue, but then is there a recommended way to dynamically control the set of fields on a serializer instance? In 3.5.3 I was passing kwargs to my serializers' __init__() methods to add, swap, or remove fields from self.fields, which I thought was more elegant than having potentially large numbers of (sub)classes for every combination of fields I might want to return for a particular view.

[xordoquy]

@kronion I don't have the time to go through the backlog but altering fields should be fine, shouldn't it ?

[kronion]

Do you mean that I need to alter the fields after __init__()? Here's an example of what I was doing before:

class ExampleSerializer(ExampleBaseSerializer):
    bar = BarSerializer()

    def __init__(self, *args, **kwargs):
        if "foo" in kwargs and kwargs.pop("foo"):
            self.fields["foo"] = FooSerializer()
        if "no_bar" in kwargs and kwargs.pop("no_bar"):
            del self.fields["bar"]
        super(ExampleSerializer, self).__init__(*args, **kwargs)

[xordoquy]

That's because you are calling self.fields before the serializer gets initialized. BaseSerializer.init sets this.