Permission_class is ignored

[martinwk]

As PandasView inherits from APIListView I would expect that the attribute permission_classes can be used
to set permission on this view. However, the following view can be accessed when logged out

class DownloadFileViewAPI(PandasView):
    queryset = Well.objects.all()
    permission_classes = (MayUploadWriteOrDownloadRead,)
    filter_class = WellFilter
   
    serializer_class        = MetaDataSerializer # extends Serializer
    pandas_serializer_class = FlatteningPandasSerializer
    renderer_classes        = [PandasExcelNoColNoIndexRenderer,
                               PandasCSVNoColNoIndexRenderer,
                               PandasJSONRenderer]

While the following view can only be accessed when logged in

class WellList(generics.ListAPIView):
    queryset = Well.objects.all()
    permission_classes = (MayUploadWriteOrDownloadRead,)
    serializer_class = WellSerializer
    filter_class = WellFilter

The only difference is the serializer class and the View they inherit from so I would say this is something with PandasView, but I cannot guess why. Am I missing something here?

Adding these mixin's restricts the view to logged in users again.

class DownloadFileViewAPI(LoginRequiredMixin, PandasView):

So this is my workaround for now

[sheppard]

I wasn't able to reproduce this issue - can you check that your view has permission_classes and not permission_class? PandasView directly inherits from ListAPIView so it should mostly use the same logic.

[sheppard]

Closing this for now - let me know if it's still an issue.