title: Django Rest Framework: while using generics APIview I'm not able to set permissions( permissions.py not working for individual users)
body: <p>I want the admin user to access every user detail and the non-admin user to get access to its own detail only but Instead of this non-admin user is showing the full list of every user same as the admin user while implementing this. As I've shared my views.py, permissions.py, and models.py for the same.</p>
  <p>I'm not sure whether the problem is in permisions.py or models.py as I'm new to Django.</p>
  <p>I'm using Postman for API testing and this is working fine for the admin user but for an individual user, it's not working.</p>
  <pre><code>views.py
  
  
  class UserListCreateAPIView(generics.ListCreateAPIView):
      permission_classes = [IsStaffOrTargetUser]
      queryset = User.objects.all()
      serializer_class = UserSerializer
  
  
  class UserRetrtieveUpdateDestroyAPIView(generics.RetrieveUpdateDestroyAPIView):
      permission_classes = [IsStaffOrTargetUser]
      queryset = User.objects.all()
      
      serializer_class = UserSerializer
  
  </code></pre>
  <pre><code>permissions.py
  
  class IsStaffOrTargetUser(BasePermission):
      def has_permission(self, request, view):
          # allow user to list all users if logged in user is staff
          return request.user or request.user.is_staff
   
      def has_object_permission(self, request, view, obj):
          # allow logged in user to view own details, allows staff to view all records
          return request.user.is_staff or obj == request.user
  </code></pre>
  <pre><code>models.py
  
  class User(AbstractBaseUser):
      email = models.EmailField(verbose_name='Email',max_length=255,unique=True)
      name = models.CharField(max_length=200)
      contact_number= models.IntegerField()
      gender = models.IntegerField(choices=GENDER_CHOICES)
      address= models.CharField(max_length=100)
      state=models.CharField(max_length=100)
      city=models.CharField(max_length=100)
      country=models.CharField(max_length=100)
      pincode= models.IntegerField()
      dob = models.DateField(null= True)
  
  
      # is_staff = models.BooleanField(default=False)
      is_active = models.BooleanField(default=True)
      is_admin = models.BooleanField(default=False)
      created_at = models.DateTimeField(auto_now_add=True)
      updated_at = models.DateTimeField(auto_now=True)
  
      objects = UserManager()
  
      USERNAME_FIELD = 'email'
      REQUIRED_FIELDS = ['name','contact_number','gender','address','state','city','country','pincode','dob']
  
      def __str__(self):
          return self.email
  
      def has_perm(self, perm, obj=None):
          &quot;Does the user have a specific permission?&quot;
          # Simplest possible answer: Yes, always
          return self.is_admin
  
      def has_module_perms(self, app_label):
          &quot;Does the user have permissions to view the app `app_label`?&quot;
          # Simplest possible answer: Yes, always
          return True
  
      @property
      def is_staff(self):
          &quot;Is the user a member of staff?&quot;
          # Simplest possible answer: All admins are staff
          return self.is_admin
  
  </code></pre>