Default Permissions

[SeanWoo]

Issue:

When you set new permission classes via the class attribute or decorators you're telling the view to ignore the default list set in the settings.py file.
This is an entry from the documentation
There are times when you have a lot of default settings, but you want to add additional permissions to a certain endpoint, then you have to re-write each class from the default setting. Because of this, problems arise, you cannot replace the permission in one place with any other, you will have to go through each ViewSet where there are custom permissions and change it there.

Solution:

I suggest adding to rest_framework.permissions a DefaultPermission class which will enforce all specified classes in api_settings.DEFAULT_PERMISSION_CLASSES

I can create a Pull Request, I have a small DefaultPermission class that enforces all default permissions.

[Viicos]

I am not sure if I really understood the question, but to add extra permissions from the default ones you could use:

from rest_framework import api_settings

class MyViewSet(viewsets.ModelViewSet):
    permission_classes = api_settings["DEFAULT_PERMISSION_CLASSES"] + [...]

and add additional permissions in [...]

[SeanWoo]

That's right, but it's not very readable and it's used a lot, we can add a wrapper class over it.
For example:

class MyViewSet(viewsets.ModelViewSet):
    permission_classes = (DefaultPermission, ...)