Django Rest Framework custom permissions per view

Question

I want to create permissions in Django Rest Framework, based on view + method + user permissions. Is there a way to achieve this without manually writing each permission, and checking the permissions of the group that the user is in? Also, another problem I am facing is that permission objects are tied up to a certain model. Since I have views that affect different models, or I want to grant different permissions on the method PUT, depending on what view I accessed (because it affects different fields), I want my permissions to be tied to a certain view, and not to a certain model. Does anyone know how this can be done? I am looking for a solution in the sort of: Create a Permissions object with the following parameters: `View_affected`, `list_of_allowed_methods(GET,POST,etc.)` Create a Group object that has that permission associated Add a user to the group Have my default permission class take care of everything. From what I have now, the step that is giving me problems is step 1. B…

Accepted Answer

Well, the first step could be done easy with DRF. See http://www.django-rest-framework.org/api-guide/permissions#custom-permissions.

You must do something like that:

```
from functools import partial

from rest_framework import permissions

class MyPermission(permissions.BasePermission):

def __init__(self, allowed_methods):
        super().__init__()
        self.allowed_methods = allowed_methods

def has_permission(self, request, view):
        return request.method in self.allowed_methods

class ExampleView(APIView):
    permission_classes = (partial(MyPermission, ['GET', 'HEAD']),)
```

Django Rest Framework custom permissions per view

Solution

Problem