How to filter foreign key fields on input schema based on the user

[alexgmin]

With these models

class User(models.Model):
    id = models.PositiveSmallIntegerField(primary_key=True) 
    
    
class Product(models.Model):
    id = models.PositiveSmallIntegerField(primary_key=True) 
    name = models.CharField(max_length=255)
    public_id = models.UUIDField()
    owner = models.ForeignKey(User, on_delete=models.CASCADE)
    

class Sale(models.Model):
    product = models.ForeignKey(Product, on_delete=models.CASCADE)

If I have and enpoint that allows a user to create an Sale, how do I make sure that the product the sale will have belongs to that user?

So it's not only a custom queryset for the product_id field in the IN schema, is also dynamic depending on the user.
I also would like to know how it is possible to make it use the public_id instead of the id.

In DRF, this would be a custom RelatedField with a queryset argument, but I have no idea how this is done in Django Ninja or Pydantic.

I'm kinda guessing is this feature in pydantic V2, which is soon to be supported in stable with django-ninja.

Is there a workaround for Pydantic V1?

[vitalik]

well to me this looks like a business logic that you should do inside a view function... I guess something like this:

class SalePayload(Schema):
    product_id: int

@api.post("/sales")
def create_sale(request, payload: SalePayload):
     product = get_object_or_404(Product.objects.filter(owner=request.user), id=payload.product_id)
     #                   ^ this will return 404 if user tries to create a sale with product that not owner of
     Sale.objects.create(product)

[alexgmin]

I come from DRF, so my way of doing things may not be how django ninja works.

A 404 doesn't work from my point of view, since a 404 error when creating an object in POST doesn't make much sense
In my mind this would be a 400 or 422 validation error in that specific field, like this:

{
    "detail": [
        {
            "loc": [
                "body",
                "sale_creation",
                "product_id"
            ],
            "msg": "not found",
            "type": "value_error.not_found"
        }
    ]
}

I tried to adapt to the pydantic error structure based on a quick test. Although ideally from my point of view the "sale_creation" in loc wouldn't be there since the entire body is the sale_creation schema, and "body" already clarifies that.

What would be the correct way to do something like this? Extending ninja.errors.ValidationError? I couldn't find in the documentation how to approach something like that, since the error structure ideally should be the same as the Pydantic ones, for standarizing purposes for the API client.

Kinda related thing, is there an way to have different error handlers depending on the endpoint/urls?
For example V1 could use a different error response format than V2 endpoints.

[vitalik]

maybe like this:

class SalePayload(Schema):
    product_id: int

@api.post("/sales")
def create_sale(request, payload: SalePayload):
     qs = Product.objects.filter(owner=request.user)
     try:
          product = qs.get(id=payload.product_id)
     except Product.DoesNotExist:
          raise ValidationError(details...)
     Sale.objects.create(product)

that's for ninja v0.x probably the most logical way

in django ninja v1.0 (pip install django-ninja==1.0rc0) and pydantic2

you can create your own validator and it will take request in context

class SalePayload(Schema):
    product_id: int

    @field_validator('product_id')
    @classmethod
    def validate_product_id(cls, v: int, info):
        request = info.context["request"]
        if Product.objects.filter(id=v, owner=request.user).count() == 0:
               raise ValueError(f'User does not have product with id="{v}"')
        return v