For simplicity, I have created only two serializers:

- one for read operations
- one for write operations

You can create separate serializers for each action—list, retrieve, create, update—depending on your requirements.

For this example, I am using only the ItemSubCat model, because its transactions include the item_cat foreign key, which could potentially reference data from another tenant and can cause malicious cross tenant data. 

So the serializers are - 

```
class ItemSubCatWriteSerializer(ModelSerializer):
    class Meta:
        model = ItemSubCat
        fields = '__all__'
        read_only_fields = ('tenant',)


class ItemSubCatReadSerializer(ModelSerializer):
    cat_name = serializers.ReadOnlyField(source='item_cat.name')
    class Meta:
        model = ItemSubCat
        fields = ("id", "name", "cat_name")

```

and before creating the viewset we will create a Mixin, which we can use in every view.

This mixin ensures all read requests are automatically filtered by tenant, preventing cross-tenant data leaks.


TenantFilterMixin - 

```
class TenantFilterMixin:
    def get_queryset(self):
        queryset = super().get_queryset()
        tenant = user_tenant(self.request.user.id)
        if not tenant:
            return queryset.none()
        return queryset.filter(tenant_id=tenant)

```

here this - 

```
tenant = user_tenant(self.request.user.id)
```
is my function to get the requested user tenant, You will need to define your own function for this. or if you apply tenant to user instance, you can do request.user.tenant

and finally the Viewset-


```
class ItemSubCatViewSet(TenantFilterMixin,  ModelViewSet):
    permission_classes = [IsAuthenticated, DjangoModelPermissionsWithRead]
    serializer_classes = {
        'list': ItemSubCatReadSerializer,
        'retrieve': ItemSubCatReadSerializer,
        'update': ItemSubCatWriteSerializer,
        "create": ItemSubCatWriteSerializer
    }
    default_serializer_class = ItemSubCatWriteSerializer
    queryset = ItemSubCat.objects.all()

    def get_serializer_class(self):
        return self.serializer_classes.get(self.action, self.default_serializer_class)

    def get_queryset(self):
        queryset = super().get_queryset()
        item_cat_id = self.request.query_params.get('itemCat')
        if item_cat_id:
            queryset = queryset.filter(item_cat=item_cat_id)
        return queryset


```

Notice the **TenantFilterMixin** used in the Viewset, This already helps to always filter the data based on tenant. and the -

```
 def get_queryset(self):
```

funciton, it is very powerful here,  the - 

```
queryset = super().get_queryset()
```
functional already returns the tenant filtered data, and you can extend its role to match your own requirement. 


Now any authenticated user trying to access the data, the sequence of request processing will be - 

- Call TenantFilterMixin
- Get User tenant
- Filter the data based on tenant
- Extend the get_queryset function to add additional functionality. 

I hope all these are clear.

In the next part, we will discuss how to protect against write operations.


First Part - [Defining Tenant aware Models](https://www.ranuvijay.me/blogs/tenant-aware-model-and-tenant-specific-prefix-models-id)

Third Part - [Tenant Specific Write Protection](https://www.ranuvijay.me/blogs/preventing-malicious-writes-in-multi-tenant)


Thanks.




In this part, we will define serializers for read and write operations, and build a viewset that always returns tenant-filtered data for all read operations.

Serializer, View and tenant filtered read data

Contact Me

I want to hear from you