Customizing error messages in bit operation permission classes generated by BasePermissionMetaclass

[Antoliny0919]

The DRF supports bit operations between permission classes that inherited BasePermission.
In both the check_permission method and the check_obj_permission method, if a message attribute exists in the permission class through the getattr function, the message is forwarded to a argument other than PermissionDenied to customize the error message associated with the permission.

class APIView(View):
    def check_permissions(self, request):
        for permission in self.get_permissions():
            if not permission.has_permission(request, self):
                self.permission_denied(
                    request,
                    message=getattr(permission, 'message', None),
                    code=getattr(permission, 'code', None)
                )

And the DRF supports bit operations between permission classes that inherited BasePermission.

class TestView(APIView):
  permission_classes = [X|Y]

class OR:
    def __init__(self, op1, op2):
        self.op1 = op1
        self.op2 = op2

class APIView(View)
    def has_permission(self, request, view):
        return (
            self.op1.has_permission(request, view) or
            self.op2.has_permission(request, view)
        )

    def has_object_permission(self, request, view, obj):
        return (
            self.op1.has_permission(request, view)
            and self.op1.has_object_permission(request, view, obj)
        ) or (
            self.op2.has_permission(request, view)
            and self.op2.has_object_permission(request, view, obj)
        )

In example codes such as TestView above, OR class objects are created through bit operations between permission classes, and if there are customized message attributes in each permission class delivered by the OR class generation argument, how should each message be applied to the OR class object?

The same applies to other bit operations besides or, and the current code has no choice but to use the default message regardless of the properties of the permission class delivered by the arguments.

If the And permission class created using the & operator exists and one of the permission classes passed by the argument fails, is the method to use the message set in the failed permission class a user has to implement?

[tomchristie]

Yes agree it’s non-obvious what messaging would be expected here.
We’re not likely to do anything about this as…

• REST framework is in feature freeze other than tracking ongoing Django releases & required security fixes.
• I think composite permissions were an over-design. Suggestion… use a single class with an explicit message.

[Antoliny0919]

If so, will development not proceed on this part in the future?

[tomchristie]

Don't expect many changes here. We're only focused on bugfixes and tracking Django releases at this point.