Django-rest-framework: DEFAULT_PERMISSION_CLASSES: problem with logical operations

[aminst]

Checklist

• [x] I have verified that that issue exists against the master branch of Django REST framework.
• [x] I have searched for similar issues in both open and closed tickets and cannot find a duplicate.
• [x] This is not a usage question. (Those should be directed to the discussion group instead.)
• [x] This cannot be dealt with as a third party library. (We prefer new functionality to be in the form of third party libraries where possible.)
• [x] I have reduced the issue to the simplest possible case.
• [x] I have included a failing test as a pull request. (If you are unable to do so we can still accept the issue.)

There is a great feature for logical operations(and, or, not) on permissions,
but the problem is, it doesn't work for the "DEFAULT_PERMISSION_CLASSES" in settings
because of the string representation of imports

REST_FRAMEWORK = {
    "DEFAULT_PERMISSION_CLASSES": [
        "my_permissions.CustomPermission",
        "rest_framework.permissions.IsAuthenticated",
    ],
}

what i am trying to do is something like this(same as permission_classes):

REST_FRAMEWORK = {
    "DEFAULT_PERMISSION_CLASSES": [
        "my_permissions.CustomPermission" | "rest_framework.permissions.IsAuthenticated"
    ],
}

is there a way to accomplish this so that one doesn't need to add them to every view?

[lakshaytalkstocomputer]

I think Permissions in Default Permission variable are handle from top to bottom. So you can write your Custom Permission after Is authenticated or use can use isAuthenticated in your custum Permission.

[aminst]

I think Permissions in Default Permission variable are handle from top to bottom. So you can write your Custom Permission after Is authenticated or use can use isAuthenticated in your custum Permission.

I don't get what you are suggesting.
I need OR on some permissions in DEFAULT_PERMISSION_CLASSES, I don't think changing the sequence will help it.
Could you explain more about what you are suggesting?
Thanks

[jerinpetergeorge]

A simple workaround to this problem is, create a new variable and reference the same in DRF config

# utils/permissions.py
from rest_framework.permissions import IsAuthenticated


class CustomPermission(...):
    def has_permission(self, request, view):
        # check permissions
        return ...


CombinedPermission = CustomPermission | IsAuthenticated

# settings.py
REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'utils.permissions.CombinedPermission',
    ),
    # other settings
}

BTW, I don't think we can use a | operator between the strings, as it will raise a TypeError exception

TypeError: unsupported operand type(s) for |: 'str' and 'str'

Related SO Post: How to use logical operators in DRF's DEFAULT_PERMISSION_CLASSES?

[aminst]

A simple workaround to this problem is, create a new variable and reference the same in DRF config

# utils/permissions.py
from rest_framework.permissions import IsAuthenticated


class CustomPermission(...):
    def has_permission(self, request, view):
        # check permissions
        return ...


CombinedPermission = CustomPermission | IsAuthenticated

# settings.py
REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'utils.permissions.CombinedPermission',
    ),
    # other settings
}

BTW, I don't think we can use a | operator between the strings, as it will raise a TypeError exception

TypeError: unsupported operand type(s) for |: 'str' and 'str'

Thanks a lot for you answer.
It helped me solve my problem.
🌹