python - Restrict access to only owned content django -

i'm writing api using django-tastypie. have 2 custom permisions issues i'm hoping django-guardian can fix.

i have 2 user groups clinicians , patients. clinicians should able access objects belonging patients , patients should able access objects created themselves.

my code follows:

class userresource(modelresource):     class meta:         queryset = user.objects.all()         resource_name = 'auth/user'         excludes = ['email', 'password', 'is_superuser']   class blogpostresource(modelresource):     author = fields.toonefield(userresource, 'author', full=true)      class meta:         queryset = blogpost.objects.all()         resource_name = 'posts'         allowed_methods = ["get", "post"]         # add here.         authentication = basicauthentication()         authorization = djangoauthorization()         filtering = {             'author': all_with_relations,         } 

how can used permissions restrict access on blogpostresource?

you achieve custom authorization class, example like:

class customauthorization(authorization):     def apply_limits(self, request, object_list):              ...         clin_group = group.objects.get(name='your group')         if request , hasattr(request, 'user'):             if clin_group in request.user.groups.all():                   object_list = object_list.filter(user__in=request.user.patients.all()) # or stop clinician>patient relation             else:                  object_list = object_list.filter(user=request.user)         return object_list