How to make Django REST User API with complex permissions

Question

I want to make a Django REST User API with complex permissions as follows:

GET

• Only Admin should be able to get all User data
• Logged in User should be to get himself and the names of other Users

PUT

• Only Admin and Self should be able to PUT
• Except for is_staff and is_superuser only is_superuser should be able to change the status of a user
• Password changes by a User should require the old password
• if User is !is_staff password reset should be possible

POST / DELETE

• Only Admin should be able POST/DELETE User
• User should be able to update his own Profile

Unfortunately, I have no idea how to control the view or serializer to allow such permissions. Is there a template how I can exactly control the permissions?

Answer 1

You can write your custom permission according to DRF docs.

And add YourCustomPermission in your view:

class ExampleView(APIView):
    permission_classes = (YourCustomPermission,)