Django DRF @permission_classes 不适用于 IsAdminUser 权限

Question

I want to apply IsAdminUser permission on my view. I am able to do it by setting the permission_classes attribute:

class UserProfileView(APIView):
    permission_classes = [IsAdminUser,]

    def get(self, request, pk=None):
        ...

However, if I try to do the same using decorator then it seems to be ineffective and checks only for authenticated users.

class UserProfileView(APIView):

    @permission_classes([IsAdminUser])
    def get(self, request, pk=None):
        ...

I want to understand why is it behaving so. Am I doing anything wrong? My environment configuration: Python==3.7.6, Django==2.2.10, djangorestframework==3.11.0, django-oauth-toolkit==1.2.0

Answer 1

It is not supposed to work on APIView handlers, @permission_classes just sets func.permission_classes = permission_classes and then @api_view decorator wraps function with APIView -based class. When APIView calls a handler it does not check permission_classes set on that handler, as these checks are made in the initial method. Here is a part of APIView.dispatch :

self.initial(request, *args, **kwargs)
# part of initial:
#     self.check_permissions(request)

# Get the appropriate handler method
if request.method.lower() in self.http_method_names:
    handler = getattr(self, request.method.lower(),
                      self.http_method_not_allowed)
else:
    handler = self.http_method_not_allowed

response = handler(request, *args, **kwargs)

If you want to apply different permissions to different handlers (like get or post) you can either:

1. Create your own permission class and specify it in permission_classes
2. Override check_permissions
3. Put permissions logic into handlers