[Django]-How to get OR permissions instead of AND in REST framework

Now DRF allows permissions to be composed using bitwise operators: & -and- and | -or-.

From the docs:

Provided they inherit from rest_framework.permissions.BasePermission, permissions can be composed using standard Python bitwise operators. For example, IsAuthenticatedOrReadOnly could be written:

from rest_framework.permissions import BasePermission, IsAuthenticated
from rest_framework.response import Response
from rest_framework.views import APIView

class ReadOnly(BasePermission):
    def has_permission(self, request, view):
        return request.method in SAFE_METHODS

class ExampleView(APIView):
    permission_classes = (IsAuthenticated|ReadOnly,)

    def get(self, request, format=None):
        content = {
            'status': 'request was permitted'
        }
        return Response(content)

Edited: Please note there is a comma after IsAuthenticated|ReadOnly.

You need to build your own custom http://www.django-rest-framework.org/api-guide/permissions/#custom-permissions as described in the docs.

Something like:

from rest_framework import permissions

class IsAdminOrStaff(permissions.BasePermission):
    message = 'None of permissions requirements fulfilled.'

    def has_permission(self, request, view):
        return request.user.is_admin() or request.user.is_staff()

Then in your view:

permission_classes = (IsAdminOrStaff,)

Aside from the custom permission which is simpler approach mentioned in the earlier answer, you can also look for an existing 3rd party that handle a much complex permission handling if necessary.

As of Feb 2016, those handling complex condition permission includes:

• rest_condition
• djangorestframework-composed-permissions

One way would be to add another permission class which combines existing classes the way you want it, e.g.:

class IsAdmin(BasePermission):
    """Allow access to admins"""
    def has_object_permission(self, request, view, obj):
        return request.user.is_admin()


class IsOwner(BasePermission):
    """Allow access to owners"""
    def has_object_permission(self, request, view, obj):
        request.user.is_owner(obj)


class IsAdminOrOwner(BasePermission):
    """Allow access to admins and owners"""  
    def has_object_permission(*args):
        return (IsAdmin.has_object_permission(*args) or
                IsOwner.has_object_permission(*args))

Here is a generic solution:

from functools import reduce
from rest_framework.decorators import permission_classes
from rest_framework.permissions import BasePermission


def any_of(*perm_classes):
    """Returns permission class that allows access for
       one of permission classes provided in perm_classes"""
    class Or(BasePermission):
        def has_permission(*args):
            allowed = [p.has_permission(*args) for p in perm_classes]
            return reduce(lambda x, y: x or y, allowed)

    return Or


class IsAdmin(BasePermission):
    """Allow access to admins"""

    def has_object_permission(self, request, view, obj):
        return request.user.is_admin()


class IsOwner(BasePermission):
    """Allow access to owners"""

    def has_object_permission(self, request, view, obj):
        request.user.is_owner(obj)


"""Allow access to admins and owners"""


@permission_classes((any_of(IsAdmin, IsOwner),))
def you_function(request):
    # Your logic
    ...

The easiest way would be to separate them out with | in permission_classes attribute or get_permissions method, but if you have complex rules, you can specify those rules in the check_permissions method in the viewsets class that you are defining. Something like this:

class UserProfileViewSet(viewsets.ModelViewSet):
    queryset = User.objects.all()
    serializer_class = ProfileSerializerBase
    
    def create(self, request, *args, **kwargs):
       # Create rules here

    def get_permissions(self):
        if self.action == "destroy":
            # Only Super User or Org Admin can delete record
            permission_classes = [SAPermission, OAPermission]

    def check_permissions(self, request):
    """
    Original check_permissions denies access if any one of the permission
    classes returns False, changing it so that it would deny access only if
    all classes returns False
    """
       all_permissions = []
       messages = []
       code = []
       for permission in self.get_permissions():
           all_permissions.append(permission.has_permission(request, self))
           messages.append(getattr(permission, "message", None))
           code.append(getattr(permission, "code", None))
       if True in all_permissions:
           return
       message = ",".join(i for i in messages if i)
       self.permission_denied(
           request,
           message=message if message else None,
           code=code[0],
       )