django rest permissions allow both IsAdmin and custom permission

user_2134767 0
Viewed 6264

I have a views.py as below,

from webapi.permissions import IsOwner

class MemberDetail(generics.RetrieveUpdateDestroyAPIView):
    queryset = members.objects.all()
    serializer_class = MemberSerializer
    permission_classes = (permissions.IsAdminUser,IsOwner)

And the following is custom permission to check if the user is ower of object in webapi.permissions,

class IsOwner(permissions.BasePermission):
    def has_object_permission(self, request, view, obj):
            return obj.owner == request.user

Now the issue is it is check if he is a admin user and gives permissions to update / delete, But if the owner is the user it should actually give permission to edit he data but in this case it is failing.

On seeing the question "Django Rest Framework won't let me have more than one permission" I tried as below also still it did not work when I use Or,

class MemberDetail(generics.RetrieveUpdateDestroyAPIView):
    queryset = members.objects.all()
    serializer_class = MemberSerializer
    permission_classes = (Or(permissions.IsAdminUser,IsOwner))

If I use Or it is failing with error during run time as "'Condition' object is not iterable"

django-rest-framework django-authentication django
3 Answers

Since DRF 3.9, you can use the logical bitwise operators | and & (~ was added in 3.9.2).

As outlined in the docs you would just need

    permission_classes = (permissions.IsAdminUser|IsOwner,)
user_9529320
Related