I want to make a Django REST User API with complex permissions as follows:
GET
- Only Admin should be able to get all User data
- Logged in User should be to get himself and the names of other Users
PUT
- Only Admin and Self should be able to PUT
- Except for is_staff and is_superuser only is_superuser should be able to change the status of a user
- Password changes by a User should require the old password
- if User is !is_staff password reset should be possible
POST / DELETE
- Only Admin should be able POST/DELETE User
- User should be able to update his own Profile
Unfortunately, I have no idea how to control the view or serializer to allow such permissions. Is there a template how I can exactly control the permissions?