I am trying to create some custom authentication classes to check if the request user is part of certain groups or not. However, I am getting this AttributeError: ‘User’ object has no attribute ‘user’ appear and I dont know how to resolve it.

This is the file I created for my custom authentication classes:

from rest_framework import permissions

class IsManager(permissions.BasePermission):
    def has_permission(self, request, view):
        if request.user.user.group.filter(name='managers').exists():
            return True
        else:
            return False

class IsDeliveryCrew(permissions.BasePermission):
    def has_permission(self, request, view):
        if request.user.user.group.filter(name='delivery crew').exists():
            return True
        else:
            return False

This is me view file:

from rest_framework import generics, status
from rest_framework.permissions import IsAuthenticated, IsAdminUser
from rest_framework.response import Response
from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
from django.shortcuts import get_object_or_404
from django.http import HttpResponseBadRequest
from django.contrib.auth.models import Group, User
from .models import Category, MenuItem, Cart, Order, OrderItem
from .serializers import CategorySerialzier,MenuItemSerialzier,CartHelpSerializer, CartAddSerialzier,CartRemoveSerializer, CartSerialzier, ManagerListSerializer,OrderSerialzier,OrderItemSerializer,OrderAddSerializer, OrderItemHelperSerialzier
from .permissions import IsManager, IsDeliveryCrew
from datetime import date
import math

class CategoriesView(generics.ListCreateAPIView):
    throttle_classes=[UserRateThrottle,AnonRateThrottle]
    queryset = Category.objects.all()
    serializer_class = CategorySerialzier
    permission_classes= [IsAdminUser]
    

class MenuItemsView(generics.ListCreateAPIView):
    throttle_classes=[UserRateThrottle,AnonRateThrottle]
    queryset = MenuItem.objects.all()
    serializer_class = MenuItemSerialzier
    search_fields = ['title','category__title']
    ordering_fields = ['price','category']
    
    def get_permissions(self):
        permission_classes = []
        if self.request.method != 'GET':
            permission_classes = [IsAuthenticated,IsAdminUser]   
        return [permission() for permission in permission_classes]
   
class SingleMenuItemView(generics.RetrieveUpdateDestroyAPIView):
    throttle_classes=[UserRateThrottle,AnonRateThrottle]
    queryset = MenuItem.objects.all()
    serializer_class = MenuItemSerialzier
    
    '''def get_permissions(self):
        permission_classes = [IsAuthenticated]
        if self.request.method != 'GET':
            permission_classes = [IsAuthenticated, IsManager | IsAdminUser]
        return [permission() for permission in permission_classes]
        '''
    def get_permissions(self):
        permission_classes = [IsAuthenticated]
        if self.request.method == "PATCH":
            permission_classes = [IsAuthenticated, IsManager | IsAdminUser]
        if self.request.method == "DELETE":
            permission_classes = [IsAuthenticated, IsAdminUser]
        return[permission() for permission in permission_classes]

Finally this is my error traceback:

Environment:


Request Method: GET
Request URL: http://127.0.0.1:8000/api/menu-items/1

Django Version: 4.2.13
Python Version: 3.9.7
Installed Applications:
['django.contrib.admin',
 'django.contrib.auth',
 'django.contrib.contenttypes',
 'django.contrib.sessions',
 'django.contrib.messages',
 'django.contrib.staticfiles',
 'littlelemonAPI',
 'rest_framework',
 'rest_framework.authtoken',
 'djoser']
Installed Middleware:
['django.middleware.security.SecurityMiddleware',
 'django.contrib.sessions.middleware.SessionMiddleware',
 'django.middleware.common.CommonMiddleware',
 'django.middleware.csrf.CsrfViewMiddleware',
 'django.contrib.auth.middleware.AuthenticationMiddleware',
 'django.contrib.messages.middleware.MessageMiddleware',
 'django.middleware.clickjacking.XFrameOptionsMiddleware']



Traceback (most recent call last):
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesdjangocorehandlersexception.py", line 55, in inner
    response = get_response(request)
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesdjangocorehandlersbase.py", line 220, in _get_response
    response = response.render()
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesdjangotemplateresponse.py", line 114, in render
    self.content = self.rendered_content
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesrest_frameworkresponse.py", line 74, in rendered_content
    ret = renderer.render(self.data, accepted_media_type, context)
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesrest_frameworkrenderers.py", line 726, in render
    context = self.get_context(data, accepted_media_type, renderer_context)
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesrest_frameworkrenderers.py", line 659, in get_context
    raw_data_patch_form = self.get_raw_data_form(data, view, 'PATCH', request)
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesrest_frameworkrenderers.py", line 540, in get_raw_data_form
    if not self.show_form_for_method(view, method, request, instance):
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesrest_frameworkrenderers.py", line 430, in show_form_for_method
    view.check_permissions(request)
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesrest_frameworkviews.py", line 332, in check_permissions
    if not permission.has_permission(request, self):
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesrest_frameworkpermissions.py", line 83, in has_permission
    self.op1.has_permission(request, view) or
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectlittlelemonlittlelemonAPIpermissions.py", line 5, in has_permission
    if request.user.user.group.filter(name='managers').exists():
  File "C:UsersgeorgOneDriveDocumentscodingdjangoapi graded projectvenvlibsite-packagesdjangoutilsfunctional.py", line 268, in inner
    return func(_wrapped, *args)

Exception Type: AttributeError at /api/menu-items/1
Exception Value: 'User' object has no attribute 'user'

I tried looking at other forums but whatever I tried there also didnt help.

One thing I did was try to set the authentication class for that specific method in the view file to the

Token authentication by adding:

from rest_framework.authentication import TokenAuthentication

then placing this into the class:

authentication_classes = (TokenAuthentication,)

However this now gave me a “type” object isn’t iterable error and decided that seems to be leading me further astray.

I really dont understand why this wont work because everywhere I look every always does it with request.user.group….. and has no problems.