Only My Notes

Part of the Users and Accounts section of Coddy's Django journey. Lesson 9 of 16.

Every note has an owner, but the list still shows Note.objects.all(): ada reads bob's diary. The list should show only the notes of whoever is asking.

You filter on a ForeignKey with an object, not a name. A library site lists one author's books:

author = Author.objects.get(name="Ursula K. Le Guin")
books = Book.objects.filter(author=author)

Django compares the author's id. Passing the name, filter(author="Ursula K. Le Guin"), fails with ValueError. To match on the author's name, follow the key with two underscores: filter(author__name="Ursula K. Le Guin").

Here the object to compare with is the visitor, so there is nobody to look up. Django already puts the signed in user on every request. Never take the user from the URL or a form field, which anyone can change.

Challenge

Easy

In note_list, list only the notes of the signed in user.

Try it yourself

from django.contrib.auth import login
from django.contrib.auth.decorators import login_not_required
from django.contrib.auth.forms import UserCreationForm
from django.shortcuts import get_object_or_404, redirect, render

from .forms import NoteForm
from .models import Note


def note_list(request):
    notes = Note.objects.all()
    return render(request, "notes/note_list.html", {"notes": notes})


def note_detail(request, pk):
    note = get_object_or_404(Note, pk=pk)
    return render(request, "notes/note_detail.html", {"note": note})


def note_create(request):
    if request.method == "POST":
        form = NoteForm(request.POST)
        if form.is_valid():
            note = form.save(commit=False)
            note.owner = request.user
            note.save()
            return redirect("notes:detail", pk=note.pk)
    else:
        form = NoteForm()
    return render(request, "notes/note_form.html", {"form": form})


def note_edit(request, pk):
    note = get_object_or_404(Note, pk=pk)
    if request.method == "POST":
        form = NoteForm(request.POST, instance=note)
        if form.is_valid():
            form.save()
            return redirect("notes:detail", pk=note.pk)
    else:
        form = NoteForm(instance=note)
    return render(request, "notes/note_form.html", {"form": form, "note": note})


def note_delete(request, pk):
    note = get_object_or_404(Note, pk=pk)
    if request.method == "POST":
        note.delete()
        return redirect("notes:list")
    return render(request, "notes/note_confirm_delete.html", {"note": note})


@login_not_required
def signup(request):
    if request.method == "POST":
        form = UserCreationForm(request.POST)
        if form.is_valid():
            user = form.save()
            login(request, user)
            return redirect("notes:list")
    else:
        form = UserCreationForm()
    return render(request, "notes/signup.html", {"form": form})