Permissions

    More details on how to add custom permissions to your API Endpoints can be found at the official Django REST Framework documentation

    The TokenHasScope permission class allows access only when the current access token has been authorized for all the scopes listed in the required_scopes field of the view.

    For example:

    The required_scopes attribute is mandatory.

    The TokenHasReadWriteScope permission class allows access based on the READ_SCOPE and WRITE_SCOPE configured in the settings.

    The required_scopes attribute is optional and can be used by other scopes needed in the view.

    For example:

    2.     authentication_classes = [OAuth2Authentication]
    3.     permission_classes = [TokenHasReadWriteScope]
    4.     required_scopes = ['music']

    When a request is performed both the READ_SCOPE \ WRITE_SCOPE and ‘music’ scopes are required to be authorized for the current access token.

    The TokenHasResourceScope permission class allows access only when the current access token has been authorized for all the scopes listed in the required_scopes field of the view but according of request’s method.

    When the current request’s method is one of the “safe” methods, the access is allowed only if the access token has been authorized for the scope:read scope (for example music:read). When the request’s method is one of “non safe” methods, the access is allowed only if the access token has been authorized for the scope:write scope (for example music:write).

    The IsAuthenticatedOrTokenHasScope permission class allows access only when the current access token has been authorized for all the scopes listed in the required_scopes field of the view but according to the request’s method. It also allows access to Authenticated users who are authenticated in django, but were not authenticated through the OAuth2Authentication class. This allows for protection of the API using scopes, but still let’s users browse the full browseable API. To restrict users to only browse the parts of the browseable API they should be allowed to see, you can combine this with the DjangoModelPermission or the DjangoObjectPermission.

    For example:

    1. class SongView(views.APIView):
    2.     permission_classes = [IsAuthenticatedOrTokenHasScope, DjangoModelPermission]
    3.     required_scopes = ['music']

    The required_scopes attribute is mandatory.

    The TokenMatchesOASRequirements permission class allows the access based on a per-method basis and with alternative lists of required scopes. This permission provides full functionality required by REST API specifications like the .

    The required_alternate_scopes attribute is a required map keyed by HTTP method name where each value is a list of alternative lists of required scopes.

    The following is a minimal OAS declaration that shows the same required alternate scopes. It is complete enough to try it in the swagger editor.

    1. openapi: "3.0.0"
    2. info:
    3.   title: songs
    4.   version: v1
    5. components:
    6.   securitySchemes:
    7.     song_auth:
    8.       flows:
    9.         implicit:
    10.           authorizationUrl: http://localhost:8000/o/authorize
    12.             read: read about a song
    13.             create: create a new song
    14.             update: update an existing song
    15.             delete: delete a song
    16.             post: create a new song
    17.             widget: widget scope
    18.             scope2: scope too
    19.             scope3: another scope
    20. paths:
    21.   /songs:
    22.     get:
    23.       security:
    24.         - song_auth: [read]
    25.       responses:
    26.         '200':
    27.     post:
    29.         - song_auth: [create]
    30.         - song_auth: [post, widget]
    31.       responses:
    32.         '201':
    33.           description: new song added
    34.     put:
    35.       security:
    36.         - song_auth: [update]
    37.         - song_auth: [put, widget]
    38.       responses:
    39.         '204':
    40.           description: song updated
    41.     delete:
    42.       security:
    43.         - song_auth: [delete]
    44.         - song_auth: [scope2, scope3]
    45.       responses:
    46.           description: song deleted