Django rest 框架 ViewSet 中的 chainig 权限

Question

class UserViewSet(viewsets.ModelViewSet):
    def list(self, request):
        users = User.objects.all()
        serializer = UserSerializer(users, many=True)
        return Response(serializer.data, status=status.HTTP_200_OK)

    def create(self, request):
        serializer = UserSerializer(data=request.data)

        if serializer.is_valid(raise_exception=True):
            pass

    def retrieve(self, request, pk):
        user = get_object_or_404(User, pk=pk)
        self.check_object_permissions(request, user)
        serializer = UserSerializer(user)
        return Response(serializer.data, status=status.HTTP_200_OK)

    def get_permissions(self):
        if self.action == "list":
            permission_classes = [
                IsAdminUser,
            ]
        elif self.action == "create":
            permission_classes = [AllowAny]
        else:
            permission_classes = [AccountOwnerPermission | IsAdminUser ]

        return [permission() for permission in permission_classes]

and custom permission is:

class AccountOwnerPermission(permissions.BasePermission):
    def has_object_permission(self, request, view, obj):
        print(object)
        print(request.user)
        return obj == request.user

first i dont get object permission but with help of @brian-destura at this question i fixed that part the previous question now the problem is when i chain 2 permission together it behave like AllowAny i check them one by one and both permissions work fine, one of them allow admin and one of them allow owner but when they are or together it mess everything up

Answer 1

When chaining permissions like

permission_classes = [AccountOwnerPermission, IsAdminUser]

it behaves like an AND operator between the permission classes

The best option is to create a new permission that allows either the permission logic.

class AdminOrAccountOwnerPermission(permissions.BasePermission):
    def has_object_permission(self, request, view, obj):
        return obj == request.user or request.user.id_admin

or this when the permissions used have long complex code to keep code DRY:

class AdminOrAccountOwnerPermission(permissions.BasePermission):
    def has_object_permission(self, request, view, obj):
        return AccountOwnerPermission().has_object_permission(request, view, obj) or IsAdminUser().has_object_permission(request, view, obj)

Answer 2

@Kyell already described the problem and his answer should be accepted

But I'll try to add some details:

1. When we chain two permission classes DRF creates one new OR class:

>>> from rest_framework.permissions import IsAdminUser 
>>> or_class = [IsAdminUser | IsAdminUser]
>>> len(or_class)
1
>>> print(or_class)
[<rest_framework.permissions.OperandHolder object at 0x1096d5fa0>]
>>> 

2. Django documentation says that has_object_permission (check permissions for exact object) method running after has_permission (check permissions for whole view class)

3. Let's see how looks these methods inside chained OR class:

>>> import inspect
>>> or_instance = or_class[0]()
>>> print(inspect.getsource(or_instance.has_permission))
    def has_permission(self, request, view):
        return (
            self.op1.has_permission(request, view) or
            self.op2.has_permission(request, view)
        )

>>> print(inspect.getsource(or_instance.has_object_permission))
    def has_object_permission(self, request, view, obj):
        return (
            self.op1.has_object_permission(request, view, obj) or
            self.op2.has_object_permission(request, view, obj)
        )

So we can see that DRF check both of has_permission and after that both of has_object_permission

has_permission check may be skipped because we run has_object_permission after.

But! has_object_permission is not implemented inside IsAdminUser permission class but it is implemented inside parent BasePermission class and looks like:

class BasePermission(metaclass=BasePermissionMetaclass):
    def has_object_permission(self, request, view, obj):
        return True

So IsAdminUser always return True on has_object_permission . In usual cases IsAdminUser should fail on has_permission , but in your OR class has_permission passed because it is not implemented inside AccountOwnerPermission class

Simplest solution will be to add has_permission method to AccountOwnerPermission class:

class AccountOwnerPermission(permissions.BasePermission):
    def has_permission(self, request, view, obj):
        return False