ModelSerializer exclude won't work well when field duplicate declear in Serializer

[jacky15]

Checklist

• I have verified that that issue exists against the master branch of Django REST framework.
• I have searched for similar issues in both open and closed tickets and cannot find a duplicate.
• This is not a usage question. (Those should be directed to the discussion group instead.)
• This cannot be dealt with as a third party library. (We prefer new functionality to be in the form of third party libraries where possible.)
• I have reduced the issue to the simplest possible case.
• I have included a failing test as a pull request. (If you are unable to do so we can still accept the issue.)

Steps to reproduce

I found that when I use ModelSerializer, if I set a field in ModelSerializer which is duplicate in model. Then ModelSerializer 's exclude attribute won't work well. It still return the exclude fields.

I traced down the code, and found that it failed because ModelSerializer.get_field_names exclude fields by using list. Since I have set the field in the ModelSerializer, there are two fields name in the list returned by ModelSerializer.get_default_field_names.

django model I except to have

class Car(models.Model):
    name = models.CharField(max_length=128)
    username = models.CharField(max_length=128)

serializar I have

class VersionModelSerializer(serializers.ModelSerializer):
    username = fields.IntegerField(validators=my_validator)

    class Meta:
        model = models.Car
        exclude = ('username')

Expected behavior

Excepted to return data like

{
    "name": "car_name"
}

Actual behavior

but username exists in the response like

{
    "name": "car_name",
    "username": "username"
}

according to the reason I explain above, I think ModelSerializer.get_field_names should use set instead of list to exclude fields.

[xordoquy]

In such case, DRF should fail hard and refuse to start.

[xordoquy]

From the documentation:

The names in the fields and exclude attributes will normally map to model fields on the model class.
Alternatively names in the fields options can map to properties or methods which take no arguments that exist on the model class.

So I'm in favor of closing the issue as invalid since the documentation implies exclude fields are relating to model's and not those explicitly defined in the serializer.

[carltongibson]

I’m with @xordoquy here.

I look at the example serialiser and think “why would you explicitly define a field you’re going to exclude?” No doubt there’s some reuse scenario in play but it’s not the intended use: exclude is secondary to fields, just for some quick cases, fields is to be preferred, and fields requires including defined fields. (Thus this is a feature we can live with.)