title: Django Permissions: How to make extended User only to update and view profile?
body: <p>I'm trying to write custom permissions for the extended user which I created so that it should only be allowed to see(retrieve) the user profile and update it. However with my current code, it is not allowing User to see it's profile. I've just started with Django and not able to come up with a solution, so please advise what is wrong? Below is my code:</p>
  
  <p>Permissions.py</p>
  
  <pre><code>from rest_framework import permissions
  
  
  class UserPermissions(permissions.BasePermission):
  
      def has_permission(self, request, view):
          return request.user and request.user.is_authenticated()
  
      def has_object_permission(self, request, view, obj):
          return obj == request.user
  </code></pre>
  
  <p>views.py</p>
  
  <pre><code>from rest_framework.permissions import IsAuthenticated, IsAdminUser
  from .permissions import UserPermissions
  
  
  class UserList(generics.ListCreateAPIView):
  
      queryset = UserProfile.objects.all()
      model = UserProfile
      serializer_class = UserSerializer
      paginate_by = 10
      permission_classes = (IsAuthenticated, IsAdminUser,)
  
      def get_queryset(self):
  
          queryset = UserProfile.objects.all()
          search_query = self.request.query_params.get('user', None)
  
          if search_query is not None:
              queryset = queryset.filter(username__istartswith=search_query)
          queryset = queryset.order_by('username')
          return queryset
  
  
  class UserDetail(generics.RetrieveUpdateAPIView):
  
      queryset = UserProfile.objects.all()
      model = UserProfile
      serializer_class = UserSerializer
      permission_classes = (IsAuthenticated, UserPermissions,)
  
  
  class UserDelete(generics.DestroyAPIView):
  
      queryset = UserProfile.objects.all()
      model = UserProfile
      serializer_class = UserSerializer
      permission_classes = (IsAuthenticated, IsAdminUser,)
  </code></pre>
  
  <p>Serializers.py</p>
  
  <pre><code>class UserSerializer(serializers.ModelSerializer):
  
      class Meta:
          model = UserProfile
  
      def create(self, validated_data):
  
          user = super(UserSerializer, self).create(validated_data)
          user.set_password(validated_data['password'])
          user.save()
          return user
  </code></pre>
  
  <p>models.py</p>
  
  <pre><code>from django.contrib.auth.models import User
  
  class UserProfile(User):
  
      class Meta:
  
          ordering = ["username"]
          db_table = 'user'
  
      createdby = models.CharField(max_length=100, blank=True, default="")
      updatedon = models.DateTimeField(blank=True, auto_now=True)
      is_admin = models.BooleanField(default=False)
  </code></pre>