Django REST Framework Scenario Question
Project: Vehicle Rental Management System
Roles
Role ID Role Name
1 ADMIN
2 CUSTOMER
Data Models
1️ RoleModel
Field Name Datatype Primary Key Comments
id Integer Yes Auto-increment
rolename String Unique ADMIN / CUSTOMER
2️ UserModel
Field Name Datatype Primary Key Foreign Key Comments
id Integer Yes — Auto-increment
username String No — —
email String Unique — Login via email
password String No — Hashed password
role Integer No FK to [Link] —
3️ VehicleModel
Field Name Datatype Primary Key Foreign Key Comments
id Integer Yes — Auto-increment
vehicleId Integer Unique — Unique vehicle code
brand String No — e.g., "Toyota"
type String No — e.g., "SUV"
rentPerDay Double No — —
status String No — Default: "available"
4️ BookingModel
Field Name Datatype Primary Key Foreign Key Comments
id Integer Yes — Auto-increment
startDate String No — Format: dd/MM/yyyy
endDate String No — —
bookingDate String No — —
customerId Integer No FK to [Link] —
vehicleId Integer No FK to [Link] —
JWT Authorization Rules
• JWT required for all requests except /login
• Role IDs:
o 1️ = ADMIN
o 2️ = CUSTOMER
• Header:
Authorization: Bearer <JWT_TOKEN>
Extended API Endpoints
Endpoint Method Access Description
/login POST All User login, returns JWT
/register POST ADMIN Register a new user
/vehicle/add POST ADMIN Add a new vehicle
/vehicle/list?type=SUV GET All List vehicles by type
Retrieve vehicle details by
/vehicle/detail/{vehicleId} GET All
vehicleId
/vehicle/status/{vehicleId} PATCH ADMIN Update vehicle status
/vehicle/delete/{vehicleId} DELETE ADMIN Remove a vehicle
/booking/create POST CUSTOMER Create a booking
List bookings for the logged-in
/booking/mybookings GET CUSTOMER
customer
/booking/all GET ADMIN List all bookings
CUSTOMER (own) /
/booking/detail/{id} GET Get booking details
ADMIN
CUSTOMER (own) /
/booking/delete/{id} DELETE Cancel a booking
ADMIN
/user/list GET ADMIN List all registered users
/user/detail/{id} GET ADMIN View user details
/user/update/{id} PATCH ADMIN Update user info
/user/delete/{id} DELETE ADMIN Remove a user
Endpoint Method Access Description
/vehicle/available GET All List all available vehicles
/vehicle/search?brand=Toyota GET All Search vehicles by brand
New Features to Implement
• User Registration API
o Only ADMIN can register new users with a role.
o Password must be securely hashed.
o Email must be unique.
• Vehicle Deletion
o Only ADMIN can delete a vehicle entry.
• Customer's Booking List
o Authenticated customers can view their own bookings.
o Use [Link] to filter.
• Booking Detail View
o CUSTOMER can view their own booking.
o ADMIN can view any booking.
• User Management
o List, update, delete users (ADMIN only).
o View individual user details.
• Search Vehicles by Brand
o Query parameter based search: /vehicle/search?brand=Toyota
o Use Django filter or custom queryset filtering.
• Available Vehicles
o List all vehicles with status available.
Updated JWT Role-based Access Control
• JWT token will include role in payload.
• Custom DRF permissions:
o IsAdmin
o IsCustomer
o IsBookingOwnerOrAdmin
• Use @permission_classes, APIView, and GenericAPIView as needed.