How to get OR permissions instead of AND in REST framework

Question

It seems that permission classes are ANDed when REST framework checks permissions. That is every permission class needs to return True for permission to be granted. This makes things like "if you are a superuser, you can access anything, but if you are a regular user you need explicit permissions" a bit hard to implement, you cannot just return False, it will fail the whole stack. Is there a way to maybe short-circuit permissions? Something like "if this permission is granted, stop checking?" or some other way to deal with cases like that?

Answer 1

Now DRF allows permissions to be composed using bitwise operators: & -and- and | -or-.

From the docs:

Provided they inherit from rest_framework.permissions.BasePermission, permissions can be composed using standard Python bitwise operators. For example, IsAuthenticatedOrReadOnly could be written:

from rest_framework.permissions import BasePermission, IsAuthenticated from rest_framework.response import Response from rest_framework.views import APIView  class ReadOnly(BasePermission):     def has_permission(self, request, view):         return request.method in SAFE_METHODS  class ExampleView(APIView):     permission_classes = (IsAuthenticated|ReadOnly,)      def get(self, request, format=None):         content = {             'status': 'request was permitted'         }         return Response(content) 

Edited: Please note there is a comma after IsAuthenticated|ReadOnly.