rsinger86/drf-flex-fields

Omitted fields still appears to allow saving omitted field on the model

Sbacon017 opened this issue · 0 comments

When passing omitted fields to the serializer in a views' get_serializer method, it still seems to be possible to save/update said fields, even though they're not returned in the Response.

For example:

def get_serializer(self, *args, **kwargs):
    serializer_class = self.get_serializer_class()
    kwargs.setdefault('context', self.get_serializer_context())
    kwargs.update({'omit': 'example_field'})
    return serializer_class(*args, **kwargs)

Will not return example_field in the response, however any value passed into a PUT or PATCH request for that field will still be saved on the model.

Fields don't seem to be omitted until to_representation is called, but the lateness of that call means that the serializer still contains these fields up until the response is prepared. Is this the expected behavior? It seems contrary to what I would expect.