from rest_framework import generics
from django.contrib.auth.models import User
from users.serializers import UserSerializer


class UserList(generics.ListCreateAPIView):
    queryset = User.objects.all()
    serializer_class = UserSerializer


class UserDetail(generics.RetrieveUpdateDestroyAPIView):
    queryset = User.objects.all()
    serializer_class = UserSerializer

from rest_framework import generics, permissions
from django.contrib.auth.models import User
from users.serializers import UserSerializer


class UserList(generics.ListCreateAPIView):
    queryset = User.objects.all()
    serializer_class = UserSerializer


class UserDetail(generics.RetrieveUpdateDestroyAPIView):
    permission_classes = (
        permissions.IsAuthenticatedOrReadOnly,
    )
    queryset = User.objects.all()
    serializer_class = UserSerializer

Add permission to edit user
Add permission to edit user

- from rest_framework import generics
+ from rest_framework import generics, permissions
  from django.contrib.auth.models import User
  from users.serializers import UserSerializer
  
  
  class UserList(generics.ListCreateAPIView):
      queryset = User.objects.all()
      serializer_class = UserSerializer
  
  
  class UserDetail(generics.RetrieveUpdateDestroyAPIView):
+     permission_classes = (
+         permissions.IsAuthenticatedOrReadOnly,
+     )
      queryset = User.objects.all()
      serializer_class = UserSerializer
  
Add permission to edit user
## Code Before:
from rest_framework import generics
from django.contrib.auth.models import User
from users.serializers import UserSerializer


class UserList(generics.ListCreateAPIView):
    queryset = User.objects.all()
    serializer_class = UserSerializer


class UserDetail(generics.RetrieveUpdateDestroyAPIView):
    queryset = User.objects.all()
    serializer_class = UserSerializer

## Instruction:
Add permission to edit user
## Code After:
from rest_framework import generics, permissions
from django.contrib.auth.models import User
from users.serializers import UserSerializer


class UserList(generics.ListCreateAPIView):
    queryset = User.objects.all()
    serializer_class = UserSerializer


class UserDetail(generics.RetrieveUpdateDestroyAPIView):
    permission_classes = (
        permissions.IsAuthenticatedOrReadOnly,
    )
    queryset = User.objects.all()
    serializer_class = UserSerializer
