Bài 8.1: Permissions & Authorization - Phần 1 - Permission Basics

**Series Navigation:** - **Bài 8.1 (bài này): Permission Basics** 👈 - [Bài 8.2: Object-Level Permissions](/django-advance/permissions-authorization-phan-2) - [Bài 8.3: Custom Permissions](/django-advance/permissions-authorization-phan-3) - [Bài 8.4: Advanced Authorization Patterns](/django-advance/permissions-authorization-phan-4)

Mục Tiêu Bài 8.1

Sau khi hoàn thành Bài 8.1 này, bạn sẽ:

✅ Hiểu authorization vs authentication
✅ Master permission flow trong DRF
✅ Sử dụng built-in permission classes
✅ Configure permissions globally và per-view
✅ Combine multiple permissions
✅ Handle permission errors
✅ Test permissions

Authorization Overview

Authentication vs Authorization

Authentication = "Who are you?"

Xác định danh tính user
Login, tokens, sessions

Authorization = "What can you do?"

Xác định quyền truy cập
Permissions, roles, policies

Example:

# Authenticationuser = request.user  # john@example.com # Authorizationif user.has_perm('articles.add_article'):    # User can create articles    pass

Permission Flow in DRF

Request arrives    ↓Authentication (Who are you?)    ↓Set request.user    ↓Permission Check (What can you do?)    ↓View Logic    ↓Response

Code flow:

class ArticleViewSet(viewsets.ModelViewSet):    authentication_classes = [TokenAuthentication]  # Step 1: Authenticate    permission_classes = [IsAuthenticated]          # Step 2: Check permission        def list(self, request):        # If we reach here:        # - User is authenticated        # - User has permission        articles = Article.objects.all()        serializer = ArticleSerializer(articles, many=True)        return Response(serializer.data)

When Permissions Are Checked

Permissions checked:

Before view executes
At dispatch() time
Before get(), post(), etc.

NOT checked for:

@permission_classes([AllowAny]) decorated views
permission_classes = [] (empty list)

Built-in Permission Classes

1. AllowAny

Allow all requests (authenticated or not):

from rest_framework.permissions import AllowAny class PublicArticleList(generics.ListAPIView):    queryset = Article.objects.filter(status='published')    serializer_class = ArticleSerializer    permission_classes = [AllowAny]  # Anyone can access

Use cases:

Public API endpoints
Login/registration views
Public content listing

Example:

# views.pyfrom rest_framework.decorators import api_view, permission_classesfrom rest_framework.permissions import AllowAny @api_view(['GET'])@permission_classes([AllowAny])def public_articles(request):    """Public endpoint - no authentication needed"""    articles = Article.objects.filter(status='published')    serializer = ArticleSerializer(articles, many=True)    return Response(serializer.data)

2. IsAuthenticated

Only authenticated users:

from rest_framework.permissions import IsAuthenticated class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsAuthenticated]  # Must be logged in

How it works:

# IsAuthenticated implementationclass IsAuthenticated(BasePermission):    def has_permission(self, request, view):        return bool(request.user and request.user.is_authenticated)

Use cases:

User-specific data
Protected endpoints
Most authenticated APIs

Example:

@api_view(['POST'])@permission_classes([IsAuthenticated])def create_article(request):    """Only authenticated users can create articles"""    serializer = ArticleSerializer(data=request.data)    if serializer.is_valid():        serializer.save(author=request.user)        return Response(serializer.data, status=201)    return Response(serializer.errors, status=400)

3. IsAdminUser

Only admin/staff users:

from rest_framework.permissions import IsAdminUser class AdminArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsAdminUser]  # Only admins

How it works:

# IsAdminUser implementationclass IsAdminUser(BasePermission):    def has_permission(self, request, view):        return bool(request.user and request.user.is_staff)

Use cases:

Admin panels
Management endpoints
Sensitive operations

Example:

@api_view(['DELETE'])@permission_classes([IsAdminUser])def delete_user(request, user_id):    """Only admins can delete users"""    user = get_object_or_404(User, id=user_id)    user.delete()    return Response(status=204)

4. IsAuthenticatedOrReadOnly

Authenticated: full access, Anonymous: read-only:

from rest_framework.permissions import IsAuthenticatedOrReadOnly class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsAuthenticatedOrReadOnly]

How it works:

# IsAuthenticatedOrReadOnly implementationclass IsAuthenticatedOrReadOnly(BasePermission):    def has_permission(self, request, view):        # Allow GET, HEAD, OPTIONS for everyone        if request.method in SAFE_METHODS:            return True                # POST, PUT, PATCH, DELETE only for authenticated        return bool(request.user and request.user.is_authenticated)

SAFE_METHODS:

SAFE_METHODS = ('GET', 'HEAD', 'OPTIONS')

Use cases:

Public read, authenticated write
Blog posts
Forums
Most REST APIs

Example:

class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsAuthenticatedOrReadOnly]        # GET /articles/           → Anyone    # GET /articles/1/         → Anyone    # POST /articles/          → Authenticated only    # PUT /articles/1/         → Authenticated only    # DELETE /articles/1/      → Authenticated only

5. DjangoModelPermissions

Django model permissions:

from rest_framework.permissions import DjangoModelPermissions class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [DjangoModelPermissions]

How it works:

# Maps HTTP methods to Django permissions# POST   → add_<model># PUT    → change_<model># PATCH  → change_<model># DELETE → delete_<model># GET    → No permission required (unless customized)

Django permissions:

# Automatically created for each model:# articles.add_article# articles.change_article# articles.delete_article# articles.view_article

Example:

# Grant permissions in admin or codefrom django.contrib.auth.models import User, Permission user = User.objects.get(username='john') # Add permissionpermission = Permission.objects.get(codename='add_article')user.user_permissions.add(permission) # Check permissionuser.has_perm('articles.add_article')  # True

6. DjangoModelPermissionsOrAnonReadOnly

Model permissions + anonymous read:

from rest_framework.permissions import DjangoModelPermissionsOrAnonReadOnly class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [DjangoModelPermissionsOrAnonReadOnly]        # GET    → Anyone    # POST   → Requires add_article    # PUT    → Requires change_article    # DELETE → Requires delete_article

7. DjangoObjectPermissions

Object-level permissions:

from rest_framework.permissions import DjangoObjectPermissions class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [DjangoObjectPermissions]

Requires django-guardian:

pip install django-guardian

Will cover in Part 2: Object-Level Permissions

Configuring Permissions

Global Configuration

Set default permissions:

# settings.pyREST_FRAMEWORK = {    'DEFAULT_PERMISSION_CLASSES': [        'rest_framework.permissions.IsAuthenticated',    ]}

All views now require authentication by default.

Common configurations:

1. Public API:

REST_FRAMEWORK = {    'DEFAULT_PERMISSION_CLASSES': [        'rest_framework.permissions.AllowAny',    ]}

2. Authenticated API:

REST_FRAMEWORK = {    'DEFAULT_PERMISSION_CLASSES': [        'rest_framework.permissions.IsAuthenticated',    ]}

3. Read-only public, write authenticated:

REST_FRAMEWORK = {    'DEFAULT_PERMISSION_CLASSES': [        'rest_framework.permissions.IsAuthenticatedOrReadOnly',    ]}

Per-View Configuration

Override in view:

class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer        # Override global permission    permission_classes = [AllowAny]

Different views, different permissions:

class PublicArticleList(generics.ListAPIView):    queryset = Article.objects.filter(status='published')    serializer_class = ArticleSerializer    permission_classes = [AllowAny] class PrivateArticleList(generics.ListAPIView):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsAuthenticated]

Per-Action Configuration

Different permissions per action:

class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer        def get_permissions(self):        """        Override to return different permissions per action        """        if self.action in ['list', 'retrieve']:            permission_classes = [AllowAny]        elif self.action == 'create':            permission_classes = [IsAuthenticated]        elif self.action in ['update', 'partial_update', 'destroy']:            permission_classes = [IsAuthenticated, IsOwnerOrAdmin]        else:            permission_classes = [IsAuthenticated]                return [permission() for permission in permission_classes]

With action decorator:

class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsAuthenticated]        @action(detail=False, methods=['get'], permission_classes=[AllowAny])    def public(self, request):        """Public articles - no authentication needed"""        articles = self.get_queryset().filter(status='published')        serializer = self.get_serializer(articles, many=True)        return Response(serializer.data)        @action(detail=True, methods=['post'], permission_classes=[IsAdminUser])    def feature(self, request, pk=None):        """Only admins can feature articles"""        article = self.get_object()        article.is_featured = True        article.save()        return Response({'status': 'featured'})

Function-Based Views

Decorator:

from rest_framework.decorators import api_view, permission_classesfrom rest_framework.permissions import IsAuthenticated, IsAdminUser @api_view(['GET'])@permission_classes([AllowAny])def public_view(request):    return Response({'message': 'Public'}) @api_view(['GET'])@permission_classes([IsAuthenticated])def private_view(request):    return Response({'message': f'Hello {request.user.username}'}) @api_view(['POST'])@permission_classes([IsAdminUser])def admin_view(request):    return Response({'message': 'Admin only'})

Combining Multiple Permissions

AND Logic (All must pass)

Default behavior:

class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer        # User must be authenticated AND admin    permission_classes = [IsAuthenticated, IsAdminUser]

All permissions must return True:

# IsAuthenticated.has_permission() AND IsAdminUser.has_permission()# Both must return True

OR Logic (Any can pass)

Custom OR permission:

from rest_framework.permissions import BasePermission class IsAuthenticatedOrTokenHasScope(BasePermission):    """    Allow if authenticated OR has valid scope    """    def has_permission(self, request, view):        # Check authentication        if request.user and request.user.is_authenticated:            return True                # Check token scope        token = request.auth        if token and hasattr(token, 'scope'):            return 'read' in token.scope                return False

Using operator overloading:

from rest_framework.permissions import BasePermission, OperandHolder class IsOwnerOrAdmin(BasePermission):    def has_object_permission(self, request, view, obj):        return obj.author == request.user or request.user.is_staff # OR logicpermission_classes = [IsOwnerOrAdmin | IsAdminUser] # AND logic (default)permission_classes = [IsAuthenticated & IsOwnerOrAdmin]

Permission Methods

has_permission()

View-level permission:

class CustomPermission(BasePermission):    def has_permission(self, request, view):        """        Return True if permission granted, False otherwise                Args:            request: The request object            view: The view being accessed                Returns:            bool: True if allowed, False if denied        """        # Check if user is authenticated        if not request.user.is_authenticated:            return False                # Check if user is active        if not request.user.is_active:            return False                # Check if user has specific permission        return request.user.has_perm('articles.view_article')

Examples:

# Check user roledef has_permission(self, request, view):    return request.user.role == 'editor' # Check request methoddef has_permission(self, request, view):    if request.method in SAFE_METHODS:        return True    return request.user.is_staff # Check time-baseddef has_permission(self, request, view):    from django.utils import timezone    now = timezone.now()    return 9 <= now.hour < 17  # Only 9 AM - 5 PM # Check IP addressdef has_permission(self, request, view):    allowed_ips = ['192.168.1.1', '10.0.0.1']    client_ip = get_client_ip(request)    return client_ip in allowed_ips

has_object_permission()

Object-level permission:

class IsOwnerPermission(BasePermission):    def has_object_permission(self, request, view, obj):        """        Return True if user can access this specific object                Args:            request: The request object            view: The view being accessed            obj: The object being accessed                Returns:            bool: True if allowed, False if denied        """        # Check if user owns the object        return obj.author == request.user

Examples:

# Check ownershipdef has_object_permission(self, request, view, obj):    return obj.author == request.user # Read-only for non-ownersdef has_object_permission(self, request, view, obj):    if request.method in SAFE_METHODS:        return True    return obj.author == request.user # Admin or ownerdef has_object_permission(self, request, view, obj):    return request.user.is_staff or obj.author == request.user # Check related objectdef has_object_permission(self, request, view, obj):    # Check if user is in object's allowed_users    return request.user in obj.allowed_users.all()

When is it called?

# has_object_permission() called for:# - retrieve (GET /articles/1/)# - update (PUT /articles/1/)# - partial_update (PATCH /articles/1/)# - destroy (DELETE /articles/1/)# - Custom detail actions # NOT called for:# - list (GET /articles/)# - create (POST /articles/)

Permission Messages

Custom Error Messages

from rest_framework.permissions import BasePermission class CustomPermission(BasePermission):    message = 'Custom permission denied message.'        def has_permission(self, request, view):        return False  # Always deny

Dynamic messages:

class IsOwnerPermission(BasePermission):    def has_object_permission(self, request, view, obj):        if obj.author != request.user:            self.message = f'You must be the author to access this article.'            return False        return True

Response:

{    "detail": "You must be the author to access this article."}

Testing Permissions

Basic Permission Tests

# tests.pyfrom rest_framework.test import APITestCasefrom django.contrib.auth.models import Userfrom rest_framework import status class PermissionTest(APITestCase):    def setUp(self):        self.user = User.objects.create_user('testuser', 'test@test.com', 'password')        self.admin = User.objects.create_user('admin', 'admin@test.com', 'password')        self.admin.is_staff = True        self.admin.save()        def test_unauthenticated_denied(self):        """Test unauthenticated users cannot access protected endpoint"""        response = self.client.get('/api/articles/')        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)        def test_authenticated_allowed(self):        """Test authenticated users can access endpoint"""        self.client.force_authenticate(user=self.user)        response = self.client.get('/api/articles/')        self.assertEqual(response.status_code, status.HTTP_200_OK)        def test_admin_only(self):        """Test only admins can access admin endpoint"""        # Regular user denied        self.client.force_authenticate(user=self.user)        response = self.client.get('/api/admin/users/')        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)                # Admin allowed        self.client.force_authenticate(user=self.admin)        response = self.client.get('/api/admin/users/')        self.assertEqual(response.status_code, status.HTTP_200_OK)        def test_read_only_for_anonymous(self):        """Test anonymous can read but not write"""        # Read allowed        response = self.client.get('/api/articles/')        self.assertEqual(response.status_code, status.HTTP_200_OK)                # Write denied        response = self.client.post('/api/articles/', {'title': 'Test'})        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)

Testing Custom Permissions

from myapp.permissions import IsOwnerOrAdminfrom myapp.models import Article class CustomPermissionTest(APITestCase):    def setUp(self):        self.user1 = User.objects.create_user('user1', 'user1@test.com', 'password')        self.user2 = User.objects.create_user('user2', 'user2@test.com', 'password')        self.admin = User.objects.create_user('admin', 'admin@test.com', 'password')        self.admin.is_staff = True        self.admin.save()                self.article = Article.objects.create(            title='Test Article',            content='Content',            author=self.user1        )        def test_owner_can_update(self):        """Test owner can update their article"""        self.client.force_authenticate(user=self.user1)        response = self.client.patch(            f'/api/articles/{self.article.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, status.HTTP_200_OK)        def test_non_owner_cannot_update(self):        """Test non-owner cannot update article"""        self.client.force_authenticate(user=self.user2)        response = self.client.patch(            f'/api/articles/{self.article.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)        def test_admin_can_update_any(self):        """Test admin can update any article"""        self.client.force_authenticate(user=self.admin)        response = self.client.patch(            f'/api/articles/{self.article.id}/',            {'title': 'Updated by admin'}        )        self.assertEqual(response.status_code, status.HTTP_200_OK)

Complete Example

# models.pyfrom django.db import modelsfrom django.contrib.auth.models import User class Article(models.Model):    title = models.CharField(max_length=200)    content = models.TextField()    author = models.ForeignKey(User, on_delete=models.CASCADE)    status = models.CharField(max_length=20, default='draft')    created_at = models.DateTimeField(auto_now_add=True) # views.pyfrom rest_framework import viewsetsfrom rest_framework.permissions import (    AllowAny,    IsAuthenticated,    IsAuthenticatedOrReadOnly,    IsAdminUser)from rest_framework.decorators import action class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer        def get_permissions(self):        """Dynamic permissions based on action"""        if self.action in ['list', 'retrieve']:            # Anyone can read            permission_classes = [AllowAny]        elif self.action == 'create':            # Authenticated users can create            permission_classes = [IsAuthenticated]        elif self.action in ['update', 'partial_update', 'destroy']:            # Only owner or admin can modify            permission_classes = [IsAuthenticated, IsOwnerOrAdmin]        else:            permission_classes = [IsAuthenticated]                return [permission() for permission in permission_classes]        def perform_create(self, serializer):        serializer.save(author=self.request.user)        @action(detail=False, methods=['get'], permission_classes=[AllowAny])    def published(self, request):        """Public endpoint for published articles"""        articles = self.get_queryset().filter(status='published')        serializer = self.get_serializer(articles, many=True)        return Response(serializer.data)        @action(detail=True, methods=['post'], permission_classes=[IsAdminUser])    def publish(self, request, pk=None):        """Only admins can publish articles"""        article = self.get_object()        article.status = 'published'        article.save()        return Response({'status': 'published'})

Tóm Tắt Bài 8.1

Trong Bài 8.1 này, bạn đã học:

✅ Authorization Basics:

Authorization vs Authentication
Permission flow trong DRF
When permissions are checked

✅ Built-in Permissions:

AllowAny (public access)
IsAuthenticated (authenticated only)
IsAdminUser (admin only)
IsAuthenticatedOrReadOnly (read public, write auth)
DjangoModelPermissions (Django model perms)

✅ Configuring Permissions:

Global configuration in settings
Per-view configuration
Per-action configuration
Function-based view decorators

✅ Combining Permissions:

AND logic (default)
OR logic (custom)
Multiple permission classes

✅ Permission Methods:

has_permission() (view-level)
has_object_permission() (object-level)
Custom error messages

✅ Testing:

Test authenticated/unauthenticated
Test admin permissions
Test custom permissions

Next Steps

Trong Bài 8.2, bạn sẽ học:

Object-level permissions
IsOwner pattern
django-guardian integration
Row-level security
Complex permission logic

Navigation:

← Bài 7.4: OAuth2 & Social Auth
Bài 8.1: Permission Basics (current)
Bài 8.2: Object-Level Permissions →

#access-control

Permissions & Authorization - Phần 1 - Permission Basics