title: How can I restrict inserting data on behalf of another user in Django?
body: <p>I have the following code in my django project.</p>
  <h2><code>models.py</code></h2>
  <pre><code>from django.db import models
  
  class Doctor(models.Model):
      hospital = models.ForeignKey('auth.User', on_delete=models.CASCADE)
      name = models.CharField(primary_key=True, max_length=256, unique=True)
      education = models.CharField(max_length=256)
  
  class Patient(models.Model):
      doctor = models.ForeignKey(Doctor, on_delete=models.CASCADE)
      name = models.CharField(max_length=256)
      age = models.CharField(max_length=200)
      height = models.CharField(max_length=6)
      sex = models.CharField(max_length=12)
  </code></pre>
  <h2><code>serializers.py</code></h2>
  <pre><code>from rest_framework import serializers
  from .models import Doctor, Patient
  
  class DoctorSerializer(serializers.ModelSerializer):
  
      class Meta:
  
          model = Doctor
  
          fields = [
              'name',
              'education'
          ]
  
  class PatientSerializer(serializers.ModelSerializer):
  
      class Meta:
  
          model = Patient
  
          fields = '__all__'
  </code></pre>
  <h2><code>views.py</code></h2>
  <pre><code>from rest_framework import status, permissions
  from rest_framework.response import Response
  from rest_framework.views import APIView
  from .models import Doctor, Patient
  from .serializers import DoctorSerializer, PatientSerializer
  
  class DoctorList(APIView):
  
      permission_classes = [permissions.IsAuthenticated]
      serializer_class = DoctorSerializer
  
      def get(self, request):
          doctors = Doctor.objects.filter(hospital=request.user)
          serializer = DoctorSerializer(doctors, many=True)
          return Response(serializer.data, status=status.HTTP_200_OK)
  
      def post(self, request):
          serializer = DoctorSerializer(data=request.data)
          if serializer.is_valid():
              serializer.save(hospital=request.user)
              return Response({&quot;message&quot;: &quot;Doctor inserted!&quot;}, status=status.HTTP_201_CREATED)
          return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
  
  class PatientList(APIView):
  
      permission_classes = [permissions.IsAuthenticated]
      serializer_class = PatientSerializer
  
      def get(self, request):
          patients = Patient.objects.filter(doctor__hospital=request.user)
          serializer = PatientSerializer(patients, many=True)
          return Response(serializer.data, status=status.HTTP_200_OK)
  
      def post(self, request):
          serializer = PatientSerializer(data=request.data)
          if serializer.is_valid():
              serializer.save()
              return Response({&quot;message&quot;: &quot;Patient inserted!&quot;}, status=status.HTTP_201_CREATED)
          return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
  </code></pre>
  <p>These views are then wired up with endpoints <code>doctors/</code> and <code>patients/</code> respectively. The problem I am having is restricting the owner (in this case, a hospital, yale or middlesex) from being able to insert a patient on behalf of another doctor. The following screen capture shows that I am logged in as &quot;middlesex&quot;, but have the option to insert a patient on behalf of Dr. Bob or Dr. Alice, who ARE associated with the yale hospital (owner), not the Middlesex hospital. How can I fix this so if I am logged in as &quot;middlesex&quot; I will ONLY see Dr. Fred as an option to associate the selected Dr at the hospital with a new patient? Refer to the following image for a better idea of what I am trying to get at. <a href="https://i.stack.imgur.com/eEvkI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/eEvkI.png" alt="enter image description here" /></a></p>