read_only_fields not work

[samuelchen]

I searched issues and discussions, found that read_only_fields not work with explicitly declared field or nested.

But my case has no explicitly declared fields, it's directly use UserModel in Meta. UserModel is from get_user_model().

I can update fields in read_only_fields, such as username, is_superuser and etc.

How do I make the read_only_fields read only ?

e.g.

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = UserModel
        fields = ['id', 'username', 'first_name', 'last_name', 'password',
                  'is_active', 'is_superuser', 'is_staff', 'date_joined',
                  'groups', 'user_permissions']
        read_only_fields = ['username' 'is_superuser', 'is_staff', 'groups',
                            'user_permissions', 'date_joined']
        depth = 1
        extra_kwargs = {'password': {'write_only': True}}

class UserViewSet(mixins.ListModelMixin, mixins.CreateModelMixin,
                  mixins.RetrieveModelMixin, mixins.UpdateModelMixin,
                  mixins.DestroyModelMixin,
                  viewsets.GenericViewSet):
    queryset = UserModel.objects.all()
    serializer_class = UserSerializer
    # permission_classes = [IsAuthenticated]

    def get_queryset(self):
        if self.request.user.is_staff:
            return super().get_queryset()
        else:
            return super().get_queryset().filter(id=self.request.user.id)

    def get_permissions(self):
        if self.action in ['create']:
            permission_classes = [IsAdminUser]
            return [perm() for perm in permission_classes]
        
        # ['list', 'retrieve', 'update', 'partial_udpate', 'destroy']
        return super().get_permissions()