Django-如何在DRF中向某些用户授予自定义权限？

我想授予一些用户对我的DRF API的检索访问权、一些用户的更新访问权和未经身份验证的用户的无检索/更新访问权。
在我的扩展用户模型中，我有两个字段，用于定义是否允许用户检索或更新API。我应该如何在我的DRF custom permissions类中编写逻辑来检查这两个字段，并根据True或False授予检索或更新权限？我应该为此使用视图集，还是使用单独的ListAPIView、RetrieveAPIView和UpdateAPIView类进行混合？最好的方法是什么

models.py

class UserProfile(models.Model):  
    user = models.OneToOneField(User)
    allowRetrieveAPI = models.BooleanField(default=False,)
    allowUpdateAPI = models.BooleanField(default=False,)

class Track(models.Model):    
    user = models.ForeignKey(settings.AUTH_USER_MODEL, blank=True, null=True, on_delete=models.SET_NULL, verbose_name="Submitted by", default=1)
    artist = models.CharField(max_length=100,)
    title = models.CharField(max_length=100,)

views.py

class CheckAPIPermissions(permissions.BasePermission):
    # allow retrieve if userprofile.allowReadAPI is True
    # allow update if user userprofile.allowUpdateAPI is True  

    def has_permission(self, request, view):
         # return something
    def check_object_permission(self, user, obj):
         # return something      
    def has_object_permission(self, request, view, obj):
         # return something

class TrackViewSet(viewsets.ModelViewSet):
    queryset = Track.objects.all()
    serializer_class = TrackSerializer
    permission_classes = (CheckAPIPermissions,)

---

我还没有测试过它，只是在一个关键时刻写到。

每个人都可以访问列表方法，那么？我忘了，但是如果他们能够检索，应该允许他们使用列表方法。

class CheckAPIPermissions(permissions.BasePermission): 
    # allow retrieve if userprofile.allowReadAPI is True 
    # allow update if user userprofile.allowUpdateAPI is True 

    def has_permission(self, request, view): 
        if request.user.is_superuser:
            return True
        elif request.user and request.user.is_authenticated():
            if (request.user.userprofile.allowRetrieveAPI or request.user.userprofile.allowUpdateAPI) and view.action == 'retrieve':
                return True
            elif request.user.userprofile.allowUpdateAPI and view.action == 'update':
                return True
        return False

    def check_object_permission(self, user, obj): 
        return (user and user.is_authenticated() and (user.is_staff or obj == user)) 


    def has_object_permission(self, request, view, obj): 
        if request.user.is_superuser:
            return True
        elif request.user and request.user.is_authenticated():
            if (request.user.userprofile.allowRetrieveAPI or request.user.userprofile.allowUpdateAPI) and view.action == 'retrieve':
                return request.user == obj
            elif request.user.userprofile.allowUpdateAPI and view.action == 'update':
                return request.user == obj
        return False