from rest_framework import permissions
from rest_framework.compat import is_authenticated

class CustomGroupAPIPermission(permissions.BasePermission):
    """
    Set custom permission for GroupAPI

    * GET   : accessible by admin and user
    * POST  : only accessible by admin
    """

    def has_permission(self, request, view):
        """
        Define permission based on request
        """
        if request.method == 'GET':
            return (
                request.user and
                request.user.is_staff or
                is_authenticated(request.user)
                )
        elif request.method == 'POST':
            return request.user and request.user.is_staff

class CustomUserAPIPermission(permissions.BasePermission):
    """
    Set custom permission for UserAPI

    * GET   : only accessible by admin
    * POST  : is public, everyone can create a user
    """

    def has_permission(self, request, view):
        """
        Define permission based on request method
        """
        if request.method == 'GET':
            # admin only
            return request.user and request.user.is_staff

        elif request.method == 'POST':
            # is public
            return True
        # all other methods are accepted to allow 405 response
        return True

class CustomUserDetailAPIPermission(permissions.BasePermission):
    """
    Set custom permission for user detail API

    * GET, PUT, DELETE   :
        * admin can access all users instance
        * current user only his instance
        * public is forbidden
    """
    def has_permission(self, request, view):
        """
        Give permission for admin or user to access API
        """
        return (
                request.user and
                request.user.is_staff or
                is_authenticated(request.user)
                )

    def has_object_permission(self, request, view, obj):
        """
        Compare User instance in request is equal to User instance in obj
        """
        return request.user.is_staff or obj == request.user

@@ -689,16 +689,798 @@
 _staff%0A%0A
+class CustomGroupDetailAPIPermission(permissions.BasePermission):%0A    %22%22%22%0A    Set custom permission for group detail API%0A%0A    * GET, UPDATE, DELETE :%0A        * admin can access all groups instance%0A        * current user only his groups instance%0A        * public is forbidden%0A    %22%22%22%0A%0A    def has_permission(self, request, view):%0A        %22%22%22%0A        Give permission for admin or user to access API%0A        %22%22%22%0A        return (%0A                request.user and%0A                request.user.is_staff or%0A                is_authenticated(request.user)%0A                )%0A%0A    def has_object_permission(self, request, view, obj):%0A        %22%22%22%0A        Compare User instance in request is equal to User instance in obj%0A        %22%22%22%0A        return request.user.is_staff or obj == request.user%0A%0A
 class Cu

manage user permission for group detail