code: def serve_protected_file(request, path):
      
      path = path.rstrip('/')
      try:
          file_obj = File.objects.get(file=path)
      except File.DoesNotExist:
          raise Http404('File not found %s' % path)
      if not file_obj.has_read_permission(request):
          if settings.DEBUG:
              raise PermissionDenied
          else:
              raise Http404('File not found %s' % path)
      return server.serve(request, file_obj=file_obj.file, save_as=False)
docs: Serve protected files to authenticated users with read permissions.