Composable permissions issue (v3.9)

[backbohne]

While trying out the new composable permission feature, I have the following problem:

>>> IsAuthenticated & IsStaff | IsAuthenticatedWithTwoFactor & IsCustomer
Traceback (most recent call last):
  File "/usr/lib/python3.6/code.py", line 91, in runcode
    exec(code, self.locals)
  File "<console>", line 1, in <module>
TypeError: unsupported operand type(s) for |: 'OperandHolder' and 'OperandHolder'
>>>

It seems that is posible to compose like

(IsAuthenticated | IsStaff) & IsAuthenticatedWithTowFactor

but compose two composed permissions will not work :-(

Regards
Frank

[rpkilby]

Thanks for the report. A quick look over this and it seems valid.

[xordoquy]

Indeed, I though I got those cases covered but it seems one's lacking:

In [1]: from rest_framework.permissions import IsAuthenticated, IsAdminUser                                                                                                                                 

In [2]: IsAuthenticated & IsAuthenticated                                                                                                                                                                   
Out[2]: <rest_framework.permissions.OperandHolder at 0x111c26748>

In [3]: IsAuthenticated & IsAuthenticated & IsAuthenticated                                                                                                                                                 
Out[3]: <rest_framework.permissions.OperandHolder at 0x111c37550>

In [4]: IsAuthenticated & IsAuthenticated | IsAuthenticated                                                                                                                                                 
Out[4]: <rest_framework.permissions.OperandHolder at 0x111c4c0b8>

In [5]: IsAuthenticated & IsAuthenticated | IsAuthenticated & IsAuthenticated                                                                                                                               
---------------------------------------------------------------------------
TypeError                                 Traceback (most recent call last)
<ipython-input-5-183353b366d1> in <module>
----> 1 IsAuthenticated & IsAuthenticated | IsAuthenticated & IsAuthenticated

TypeError: unsupported operand type(s) for |: 'OperandHolder' and 'OperandHolder'

In [6]: IsAuthenticated & IsAuthenticated & IsAuthenticated & IsAuthenticated                                                                                                                               
Out[6]: <rest_framework.permissions.OperandHolder at 0x111c4ceb8>

In [7]: IsAuthenticated & IsAuthenticated & IsAuthenticated | IsAuthenticated                                                                                                                               
Out[7]: <rest_framework.permissions.OperandHolder at 0x111cf9080>

[backbohne]

Thats about Python priors operators. "&" binds more that "|". If you use round bracket it becomes more visible:

(IsAuthenticated & IsAuthenticated) | (IsAuthenticated  & IsAuthenticated)