Django DRF role level permission

Question

I have developed API's using DRF. I am struggling to relate the authorization part from Django's default permission which we define in the admin section for each and every role to the API.

Let's say I have two API's Customer Management and Customer Sales and have two roles created from them at the Django admin portal. manager role will only manage customer (add, view, delete and update) whereas sales role will manage sales (add, view, delete and update) for every customer.

When I try testing them in the admin portal the permissions work fine. The corresponding role has corresponding access. If I use the same with REST API it fails to comply with permission which is defined in the backend. It is like both the roles are able to access both the API's.

How do I handle this? Should I implement my own permission system ignoring old one (auth_permission, auth_group_permissions, auth_user_user_permissions) used in Django or is there any workaround to use Django permissions to make this work?

Answer 1

You can make your permission class as below

class CustomPermission(BasePermission):
    def has_permission(self, request, view):
        if request.user.is_authenticated():
            return True if request.has_perm('can_read') else False # or stuff similar to this 
        return False

And use this CustomPermission class to your APIView 's attribute.

For more information on DRF permissions visit https://www.django-rest-framework.org/api-guide/permissions/