Wrong parameters are being handed into my custom permission classes

[nateonguitar]

I'm having an issue where the permission system is treating my custom permissions' methods like they are classmethods or staticmethods.

When hitting a breakpoint in the permission method:

def has_permission(self, request, view=None):

• self is an instance of request instead of an instance of the permission class
• request is an instance of view
• and I had to put view=None because it was crashing with missing parameter errors

Have I configured it wrong somehow?

My IsEmailVerified permission used as a default permission has been working as expected for a month, but when adding custom permissions more programmatically I get errors.

  File "/app/api/permissions.py", line 50, in has_permission
    user = request.user
                 ^^^^^^^^^^^^
AttributeError: 'ExampleViewSet' object has no attribute 'user'

settings.py:

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'api.authentication.TokenAuthentication',
    ),
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
        'api.permissions.IsEmailVerifiedPermission',
    ),
    . . .
}

permissions.py

class IsEmailVerifiedPermission(BasePermission):
    def has_permission(self, request, view=None):
        return request.user.email_verified

    def has_object_permission(self, request, view=None, obj=None):
        return request.user.email_verified


class UserCreated(BasePermission):
    def has_permission(self, request, view=None):
        # While debugging the parameters don't line up:
        # self is an instance of request
        # request is an instance of view
        # and I had to put view=None because it was crashing with missing parameter errors

    def has_object_permission(self, request, view=None, obj=None):
        # See above issue


class CanGloballyEdit(BasePermission):
    def has_permission(self, request, view=None):
        # See above issue

    def has_object_permission(self, request, view=None, obj=None):
        # See above issue

views/example.py

class ExampleViewSet(viewsets.GenericViewSet):

    serializer_class = ExampleSerializer
    
    def get_permissions(self):
        default_permissions = super(viewsets.GenericViewSet, self).get_permissions()
        if self.action == 'list':
            return [CanGloballyEdit] + default_permissions
        if self.action == 'retrieve':
            return [UserCreated] + default_permissions
        if self.action in ('update', 'partial_update'):
            return [UserCreated | CanGloballyEdit] + default_permissions
        return default_permissions

[nateonguitar]

I figured it out, I needed to hand in instances, not classes.

return [CanGloballyEdit()] + default_permissions

But how do you | or those together?

Like this?

combined = (UserCreated | CanGloballyEdit)()
return [combined] + default_permissions

This seems to work fine, but is this the intended behavior?