Chart permissions

rowers/urls.py

@@ -59,10 +59,23 @@ class RowerViewSet(viewsets.ModelViewSet):
         IsOwnerOrNot,
         )
 
+    http_method_names = ['get','patch']
+
+    
 class FavoriteChartViewSet(viewsets.ModelViewSet):
     model = FavoriteChart
     serializer_class = FavoriteChartSerializer
-    queryset = FavoriteChart.objects.all()
+    #queryset = FavoriteChart.objects.all()
+
+    def get_queryset(self):
+        r = Rower.objects.filter(user=self.request.user)
+        return FavoriteChart.objects.filter(user=r)
+
+    permission_classes = (
+        IsOwnerOrNot,
+        )
+
+    http_method_names = ['get','put','patch','delete']
     
 class StrokeDataViewSet(viewsets.ModelViewSet):
     serializer_class = StrokeDataSerializer