old_contents: from rest_framework import permissions
  
  
  class IsOwnerOrAdmin(permissions.BasePermission):
      """
      Only admins or owners can have permission
      """
      def has_permission(self, request, view):
          return request.user and request.user.is_authenticated
  
      def has_object_permission(self, request, view, obj):
          """
          If user is staff or superuser or 'owner' of object return True
          Else return false.
          """
          if not request.user.is_authenticated:
              return False
          elif request.user.is_staff or request.user.is_superuser:
              return True
          else:
              return request.user == obj.user
  
new_contents: from rest_framework import permissions
  
  
  class IsOwnerOrAdmin(permissions.BasePermission):
      """
      Only admins or owners are allowed.
      """
      def has_permission(self, request, view):
          user = request.user
          return user and user.is_authenticated
  
      def has_object_permission(self, request, view, obj):
          """
          Allow staff or superusers, and the owner of the object itself.
          """
          user = request.user
          if not user.is_authenticated:
              return False
          elif user.is_staff or user.is_superuser:
              return True
          return user == obj.user
  
subject: improve user lookup and docs (#33)