Added permissions to views

.vscode/settings.json

@@ -0,0 +1,6 @@
+{
+    "[python]": {
+        "editor.defaultFormatter": "ms-python.autopep8"
+    },
+    "python.formatting.provider": "none"
+}

project/config/settings.py

@@ -47,6 +47,7 @@ INSTALLED_APPS = [
     'corsheaders',
     'djoser',
     'accounts',
+    'permissions',
 ]
 
 MIDDLEWARE = [

project/notes/views.py

@@ -2,10 +2,11 @@ from rest_framework.permissions import IsAuthenticated
 from rest_framework import viewsets, generics
 from .serializers import NoteSerializer
 from .models import Note
+from permissions.permissions import IsOwner
 
 
 class NoteViewSet(viewsets.ModelViewSet):
-    permission_classes = [IsAuthenticated]
+    permission_classes = [IsOwner]
     serializer_class = NoteSerializer
     queryset = Note.objects.all()
 

project/permissions/permissions.py

@@ -0,0 +1,9 @@
+from rest_framework.permissions import BasePermission
+
+class IsOwner(BasePermission):
+    """
+    Custom permission to only allow the creator of an object to view and manipulate it.
+    """
+    def has_object_permission(self, request, view, obj):
+        # Only allow the creator of the object to view and manipulate it.
+        return obj.creator == request.user