title: Django Rest Framework authentication - how to implement custom decorator
body: <p>I am trying to implement TokenAuthentication using the Rest Framework, but it seems that I can't add my own custom decorators to my ViewSets because they are evaluated BEFORE the authentication.  Consider this:</p>
  
  <pre><code>from django.utils.decorators import method_decorator
  from django.http.response import HttpResponseForbidden
  
  def require_staff(View):
      def staffOnly(function):
          def wrap(request, *args, **kwargs):
              if request.user.is_active and request.user.is_staff:
                  return function(request, *args, **kwargs)
              else:
                  return HttpResponseForbidden()
          return wrap
  
      View.dispatch = method_decorator(staffOnly)(View.dispatch)
      return View
  </code></pre>
  
  <p>When I try to implement this, it seems the decorator code fires first, so the authentication is never run.</p>
  
  <pre><code>@require_staff
  class CustomerViewSet(ModelViewSet):
      model = Customer
  
      filter_class = CustomerFilter
      filter_backends = (DjangoFilterBackend,)
  </code></pre>
  
  <p>Since <strong>request.user</strong> is never set, introducing the decorator breaks authentication.</p>
  
  <p>I think the issue is that Authentication is occuring the rest_frameworks dispatch() function and it is not clear to me how I could add additional (say) custom security if authentication is done that late in the game.</p>
  
  <p>Am I missing something here, or what is the proper way to implement this customization?</p>
  
  <p>Someone suggested using Permissions for this instead.  I assume they mean custom DRF Permissions, right?</p>