Permissions uses lazy evaluation when composing permissions

Author: FMCorz

rest_framework/permissions.py

@@ -44,13 +44,13 @@ def __init__(self, op1, op2):
 
     def has_permission(self, request, view):
         return (
-            self.op1.has_permission(request, view) &
+            self.op1.has_permission(request, view) and
             self.op2.has_permission(request, view)
         )
 
     def has_object_permission(self, request, view, obj):
         return (
-            self.op1.has_object_permission(request, view, obj) &
+            self.op1.has_object_permission(request, view, obj) and
             self.op2.has_object_permission(request, view, obj)
         )
 
@@ -62,13 +62,13 @@ def __init__(self, op1, op2):
 
     def has_permission(self, request, view):
         return (
-            self.op1.has_permission(request, view) |
+            self.op1.has_permission(request, view) or
             self.op2.has_permission(request, view)
         )
 
     def has_object_permission(self, request, view, obj):
         return (
-            self.op1.has_object_permission(request, view, obj) |
+            self.op1.has_object_permission(request, view, obj) or
             self.op2.has_object_permission(request, view, obj)
         )
 

tests/test_permissions.py

@@ -3,6 +3,7 @@
 import base64
 import unittest
 import warnings
+from unittest import mock
 
 import django
 from django.contrib.auth.models import AnonymousUser, Group, Permission, User
@@ -600,3 +601,83 @@ def test_several_levels_and_precedence(self):
             permissions.IsAuthenticated
         )
         assert composed_perm().has_permission(request, None) is True
+
+    def test_or_lazyness(self):
+        request = factory.get('/1', format='json')
+        request.user = AnonymousUser()
+
+        with mock.patch.object(permissions.AllowAny, 'has_permission', return_value=True) as mock_allow:
+            with mock.patch.object(permissions.IsAuthenticated, 'has_permission', return_value=False) as mock_deny:
+                composed_perm = (permissions.AllowAny | permissions.IsAuthenticated)
+                hasperm = composed_perm().has_permission(request, None)
+                self.assertIs(hasperm, True)
+                mock_allow.assert_called_once()
+                mock_deny.assert_not_called()
+
+        with mock.patch.object(permissions.AllowAny, 'has_permission', return_value=True) as mock_allow:
+            with mock.patch.object(permissions.IsAuthenticated, 'has_permission', return_value=False) as mock_deny:
+                composed_perm = (permissions.IsAuthenticated | permissions.AllowAny)
+                hasperm = composed_perm().has_permission(request, None)
+                self.assertIs(hasperm, True)
+                mock_deny.assert_called_once()
+                mock_allow.assert_called_once()
+
+    def test_object_or_lazyness(self):
+        request = factory.get('/1', format='json')
+        request.user = AnonymousUser()
+
+        with mock.patch.object(permissions.AllowAny, 'has_object_permission', return_value=True) as mock_allow:
+            with mock.patch.object(permissions.IsAuthenticated, 'has_object_permission', return_value=False) as mock_deny:
+                composed_perm = (permissions.AllowAny | permissions.IsAuthenticated)
+                hasperm = composed_perm().has_object_permission(request, None, None)
+                self.assertIs(hasperm, True)
+                mock_allow.assert_called_once()
+                mock_deny.assert_not_called()
+
+        with mock.patch.object(permissions.AllowAny, 'has_object_permission', return_value=True) as mock_allow:
+            with mock.patch.object(permissions.IsAuthenticated, 'has_object_permission', return_value=False) as mock_deny:
+                composed_perm = (permissions.IsAuthenticated | permissions.AllowAny)
+                hasperm = composed_perm().has_object_permission(request, None, None)
+                self.assertIs(hasperm, True)
+                mock_deny.assert_called_once()
+                mock_allow.assert_called_once()
+
+    def test_and_lazyness(self):
+        request = factory.get('/1', format='json')
+        request.user = AnonymousUser()
+
+        with mock.patch.object(permissions.AllowAny, 'has_permission', return_value=True) as mock_allow:
+            with mock.patch.object(permissions.IsAuthenticated, 'has_permission', return_value=False) as mock_deny:
+                composed_perm = (permissions.AllowAny & permissions.IsAuthenticated)
+                hasperm = composed_perm().has_permission(request, None)
+                self.assertIs(hasperm, False)
+                mock_allow.assert_called_once()
+                mock_deny.assert_called_once()
+
+        with mock.patch.object(permissions.AllowAny, 'has_permission', return_value=True) as mock_allow:
+            with mock.patch.object(permissions.IsAuthenticated, 'has_permission', return_value=False) as mock_deny:
+                composed_perm = (permissions.IsAuthenticated & permissions.AllowAny)
+                hasperm = composed_perm().has_permission(request, None)
+                self.assertIs(hasperm, False)
+                mock_allow.assert_not_called()
+                mock_deny.assert_called_once()
+
+    def test_object_and_lazyness(self):
+        request = factory.get('/1', format='json')
+        request.user = AnonymousUser()
+
+        with mock.patch.object(permissions.AllowAny, 'has_object_permission', return_value=True) as mock_allow:
+            with mock.patch.object(permissions.IsAuthenticated, 'has_object_permission', return_value=False) as mock_deny:
+                composed_perm = (permissions.AllowAny & permissions.IsAuthenticated)
+                hasperm = composed_perm().has_object_permission(request, None, None)
+                self.assertIs(hasperm, False)
+                mock_allow.assert_called_once()
+                mock_deny.assert_called_once()
+
+        with mock.patch.object(permissions.AllowAny, 'has_object_permission', return_value=True) as mock_allow:
+            with mock.patch.object(permissions.IsAuthenticated, 'has_object_permission', return_value=False) as mock_deny:
+                composed_perm = (permissions.IsAuthenticated & permissions.AllowAny)
+                hasperm = composed_perm().has_object_permission(request, None, None)
+                self.assertIs(hasperm, False)
+                mock_allow.assert_not_called()
+                mock_deny.assert_called_once()