寫了一個特別簡單的view：

@csrf_exempt
@login_required()
@authentication_classes([TokenAuthentication])
@permission_classes([IsAdminUser, IsAuthenticated])
def department_management_view(request):if request.method == 'POST':department_name = request.POST.get('department_name')Department.objects.create(name=department_name)all_departments = Department.objects.all()return render(request, 'department_management.html', {"departments": all_departments})

對應的URL：http://localhost/department_management

功能也很簡單就是對department數據對象進行增刪改查，而且這個對象只有一個字段。

當用一個非“admin”的用戶登錄系統后，仍然可以訪問這個URL，但是本意是只有“admin”用戶才可以訪問。找了一圈，在rest_framework官方文檔中發現了線索，加上@api_view裝飾就可以了：

?

@api_view(['GET', 'POST'])
@csrf_exempt
@login_required()
@authentication_classes([TokenAuthentication])
@permission_classes([IsAdminUser, IsAuthenticated])
def department_management_view(request):if request.method == 'POST':department_name = request.POST.get('department_name')Department.objects.create(name=department_name)all_departments = Department.objects.all()return render(request, 'department_management.html', {"departments": all_departments})

???????