We know that a ModelViewSet in Django Rest Framework can have methods such as Create, Get, Update, Delete and more.

In this article we will see how we can give a seperate permission to each of the methods in a ViewSet.

If we dont use a ModelViewSet and use Generic Views of Django Rest Framework, such as CreateApiView, ListApiView, DestroyApiView or any we can simply provide our permission class to each  Class as in following example.

```
class ExampleView(ListAPIView):
    serializer_class = ExampleSerializer
    permission_classes = [IsAuthenticated,]

    def get_queryset(self):
            queryset = DocSeries.objects.all()
            return queryset

```

But then we will have to create multiple Api endpoint for different tasks of the same model, an api to get the data, another for the post request and another to delete, but again this can be usefull in certain case. 

We will now see how to use ModalViewSet to define our permissions.

Lets take this ViewSet as an example - 


```
class ExampleViewSet(ModelViewSet):
    queryset = ExampleModel.objects.all()
    serializer_class = EXampleSerializer

    def create(self, request, *args, **kwargs):
        serializer = self.get_serializer(data=request.data)
        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data, status=status.HTTP_201_CREATED)
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

    def list(self, request, *args, **kwargs):
        queryset = ExampleModel.objects.all()
        serializer = self.get_serializer(queryset, many=True)
        return Response(serializer.data)
```


As we can see reight now we dont have any permission applied to our view class and so this will be accessible by all the users, or as per our project wise permission setup in setting. py file.

To give a seperate permission to each methods, we will have to define our own custom permission class and then we can apply that permission class to our ExampleViewSet. 


```
from rest_framework.permissions import BasePermission
GET_METHODS = ['GET', 'OPTIONS']
class CustomPermission(BasePermission):
    def has_permission(self, request, view):
        if (request.method in GET_METHODS):
            return False
        return True

```

We can now use this CustomPermission in our ExampleViewSet

```
permission_classes = [CustomPermission,]
```

Understanding the above code, in short this will allow you to create a new record but not allow to see all the previous created records, it allows POST request but not GET request.

In detail  - we extended the BasePermission class and modified it as per our requiremens. So if a request type is GET, OPTIONS it will return False and does not allow the access and in all other case it will allow. 

Please include HEAD, OPTIONS also in the custompermission class in real projects. all I did was to understand the topic.

here is the image of how this looks - 

![Screenshot from 2024-07-31 16-55-20.png](https://api.ranuvijay.me/uploads/Screenshot_from_2024_07_31_16_55_20_24451c5528.png)

We can further modify the CustomPermission class as per our requirement such as add request.user.isAuthenticated to check if a user is authenticated ot not, or simply use both IsAuthticated and CustomPermission as our permission_class in ModelViewSet


```
permission_classes = [IsAuthenticated , CustomPermission]
```

From Django Documentaion - > we can also use this technique to block acess from blocked ip addresses  such as [Link](https://www.django-rest-framework.org/api-guide/permissions/#examples) - 


```
class BlocklistPermission(permissions.BasePermission):
    def has_permission(self, request, view):
        ip_addr = request.META['REMOTE_ADDR']
        blocked = Blocklist.objects.filter(ip_addr=ip_addr).exists()
        return not blocked
```


Hope this is clear to understand, i request to please provide the feedback. 

Thanks!

We will see how to use different permissions for methods in a ModelViewSet. A ViewSet has Create, Delete, Get, Update, etc methods. We will see how to use different permissions for each method.  

Separate Permissions for methods in ViewSet

Contact Me

I want to hear from you