DRF Permissions

What we're doing: Close the project by default, then open a health endpoint and a staff-only report deliberately.

REST_FRAMEWORK = {
    "DEFAULT_PERMISSION_CLASSES": ["rest_framework.permissions.IsAuthenticated"],
}

class HealthView(APIView):
    authentication_classes = []
    permission_classes = [AllowAny]

class RevenueReportView(generics.ListAPIView):
    queryset = Order.objects.all()
    serializer_class = RevenueSerializer
    permission_classes = [IsAdminUser]

2

The one line that changes the failure mode of the whole project: a new view that forgets `permission_classes` now inherits "signed in required" instead of "public".

6

Emptying `authentication_classes` too keeps a health check cheap — no session lookup, no token query, on an endpoint a load balancer hits constantly.

12

`IsAdminUser` is `is_staff`. If this report should be superuser-only, the shipped classes do not cover it and a custom class is needed.

Why this works: Defaulting to `IsAuthenticated` and opening endpoints one at a time turns a forgotten permission into a 403 during development rather than a public endpoint discovered in production — the mistake becomes loud instead of silent.

What we're doing: Let anyone read published orders, but restrict edits to the owner — with the list scoped so nothing leaks.

class IsOwnerOrReadOnly(BasePermission):
    def has_permission(self, request, view):
        # cheap gate: reads are open, writes need a signed-in user
        return request.method in SAFE_METHODS or request.user.is_authenticated

    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True
        return obj.customer_id == request.user.id


class OrderViewSet(viewsets.ModelViewSet):
    serializer_class = OrderSerializer
    permission_classes = [IsOwnerOrReadOnly]

    def get_queryset(self):
        if not self.request.user.is_authenticated:
            return Order.objects.filter(is_public=True)
        return Order.objects.filter(
            Q(is_public=True) | Q(customer=self.request.user)
        )

2–4

The view-level half rejects an anonymous write immediately, before a query runs. It cannot check ownership — no object exists at this point.

6–9

The object-level half compares `obj.customer_id` to `request.user.id`. Comparing the `_id` attribute avoids a second query that `obj.customer` would trigger.

16–21

This — not the permission class — is what stops `GET /orders/` from returning someone else's rows. DRF never calls `has_object_permission()` for a list.

Why this works: The two halves cover different attack shapes. Without `get_queryset()` scoping, a list request enumerates every order in the table. Without `has_object_permission()`, a direct `PATCH /orders/57/` edits an order the caller happens to know the id of. Both are needed; neither substitutes for the other.

What we're doing: Give support agents read access to any order while keeping writes with the owner — and stop a customer refunding their own order through a valid-looking payload.

class InGroup(BasePermission):
    group_name = None

    def has_permission(self, request, view):
        return request.user.groups.filter(name=self.group_name).exists()


class IsSupportAgent(InGroup):
    group_name = "support"


class OrderViewSet(viewsets.ModelViewSet):
    serializer_class = OrderSerializer
    permission_classes = [IsAuthenticated & (IsOwnerOrReadOnly | IsAdminUser)]


class OrderSerializer(serializers.ModelSerializer):
    class Meta:
        model = Order
        fields = ["id", "items", "total", "status"]
        read_only_fields = ["status", "total"]

# Refunds move through their own endpoint, guarded by its own permission:
#   POST /orders/57/refund/  ->  @action(detail=True, permission_classes=[IsAdminUser])

1–9

One base class plus a subclass per role replaces a family of near-identical permissions — and stays a *class*, which is what DRF's operators need. `has_permission()` is the right hook: group membership is a property of the caller, not of the row.

14

The composed expression states the rule once: signed in, and then either the owner (with reads open to all) or staff. No `IsOwnerOrAdmin` class is needed.

21

The line that actually prevents the refund. `status` and `total` are server-controlled, so making them read-only removes them from the writable surface entirely.

24

A state change with its own authorization rule gets its own endpoint and its own permission — explicit, auditable, and impossible to reach through a generic PATCH.

Why this works: Composition keeps the access rule readable in one line, and `read_only_fields` closes the gap composition cannot: a permission class decides whether the request may proceed, not which fields it may carry. Those are different questions, and only the serializer answers the second.