This permission class ties into Django's standard`django.contrib.auth`[model permissions][contribauth]. This permission must only be applied to views that have a`.queryset` property or`get_queryset()` method. Authorization will only be granted if the user*is authenticated* and has the*relevant model permissions* assigned. The appropriate model is determined by checking`get_queryset().model` or`queryset.model`.

*`GET` requests require the user to have the`view` or`change` permission on the model

*`POST` requests require the user to have the`add` permission on the model.

*`PUT` and`PATCH` requests require the user to have the`change` permission on the model.

*`DELETE` requests require the user to have the`delete` permission on the model.

The defaultbehaviour can also be overridden to support custom model permissions.

The defaultbehavior can also be overridden to support custom model permissions. For example, you might want to include a`view` model permission for`GET` requests.

To use custom model permissions, override`DjangoModelPermissions` and set the`.perms_map` property. Refer to the source code for details.

perms_map= {

'GET': ['%(app_label)s.view_%(model_name)s'],

'GET': [],

'OPTIONS': [],

'HEAD': ['%(app_label)s.view_%(model_name)s'],

'HEAD': [],

'POST': ['%(app_label)s.add_%(model_name)s'],

'PUT': ['%(app_label)s.change_%(model_name)s'],

'PATCH': ['%(app_label)s.change_%(model_name)s'],

queryset=self._queryset(view)

perms=self.get_required_permissions(request.method,queryset.model)

change_perm=self.get_required_permissions('PUT',queryset.model)

user=request.user

ifrequest.method=='GET':

returnuser.has_perms(perms)oruser.has_perms(change_perm)

returnuser.has_perms(perms)

returnrequest.user.has_perms(perms)

classDjangoModelPermissionsOrAnonReadOnly(DjangoModelPermissions):

user.user_permissions.set([

Permission.objects.get(codename='add_basicmodel'),

Permission.objects.get(codename='change_basicmodel'),

Permission.objects.get(codename='delete_basicmodel'),

Permission.objects.get(codename='view_basicmodel')

Permission.objects.get(codename='delete_basicmodel')

])

user=User.objects.create_user('updateonly','updateonly@example.com','password')

response=get_queryset_list_view(request,pk=1)

self.assertEqual(response.status_code,status.HTTP_201_CREATED)

deftest_has_get_permissions(self):

request=factory.get('/',HTTP_AUTHORIZATION=self.permitted_credentials)

response=root_view(request)

self.assertEqual(response.status_code,status.HTTP_200_OK)

request=factory.get('/1',HTTP_AUTHORIZATION=self.updateonly_credentials)

response=root_view(request,pk=1)

self.assertEqual(response.status_code,status.HTTP_200_OK)

deftest_has_put_permissions(self):

request=factory.put('/1', {'text':'foobar'},format='json',

HTTP_AUTHORIZATION=self.permitted_credentials)

response=root_view(request,pk=1)

self.assertEqual(response.status_code,status.HTTP_403_FORBIDDEN)

deftest_does_not_have_get_permissions(self):

request=factory.get('/',HTTP_AUTHORIZATION=self.disallowed_credentials)

response=root_view(request)

self.assertEqual(response.status_code,status.HTTP_403_FORBIDDEN)

request=factory.get('/1',HTTP_AUTHORIZATION=self.disallowed_credentials)

response=root_view(request,pk=1)

self.assertEqual(response.status_code,status.HTTP_403_FORBIDDEN)

deftest_does_not_have_put_permissions(self):

request=factory.put('/1', {'text':'foobar'},format='json',

HTTP_AUTHORIZATION=self.disallowed_credentials)