title: How to set permissions for an inherited User model from AbstractBaseUser with Django restframework
body: <p>lets have a structure of my User model.</p>
  
  <pre><code>BaseUser &lt;- BusinessOwner &lt;- Business Staff (BusinessOwner can create,update,delete BusinessStaff )
  BaseUser &lt;- Customer
  </code></pre>
  
  <p>I'm having problem when creating an inherited user from AbstractBaseUser, All i want is to add a row in <code>myappname_baseuser_user_permissions</code> table which has columns : <code>id</code> , <code>baseuser_id</code>, <code>permission_id</code>, with correct permissions assign to correct user <code>id</code>, such as : <code>add_staff</code>, <code>change_staff</code>, <code>delete_staff</code></p>
  
  <p>Things is normal when i create new BusinessOwner user with admin page and easily add permissions, but not the POST method im using with django restframework, there are no permissions. So where should i put my permissions code? and what is the code? in <code>model.py</code> or <code>view.py</code> ? ,my permissions codename are : <code>add_staff</code>, <code>change_staff</code>, and <code>delete_staff</code></p>
  
  <p>here is my <code>model.py</code>:</p>
  
  <pre><code>class UserManager(BaseUserManager):
      def _create_user(self, email, password, is_staff, is_superuser, **extra_fields):
  
      now = timezone.now()
          if not email:
              raise ValueError('The given email must be set')
          email = self.normalize_email(email)
          user = self.model(email=email,
                  is_staff=is_staff, is_active=True,
                  is_superuser=is_superuser, last_login=now,
                  date_joined=now, **extra_fields)
      user.set_password(password)
      user.save(using=self._db)
      return user
  
      def create_user(self, email, password=None, **extra_fields):
          return self._create_user(email, password, False, False,
                               **extra_fields)
  
      def create_superuser(self, email, password, **extra_fields):
          return self._create_user(email, password, True, True,
                               **extra_fields)
  
  class BaseUser(AbstractBaseUser, PermissionsMixin):
      first_name=models.CharField(max_length=20)
      last_name=models.CharField(max_length=20)
      email=models.EmailField(max_length=254, unique=True)
      is_staff = models.BooleanField(default=False)
      is_active = models.BooleanField(default=True)
      date_joined = models.DateTimeField(default=timezone.now)
  
      objects = UserManager()
  
      USERNAME_FIELD = 'email'
      REQUIRED_FIELDS = []
      class Meta:
          verbose_name = _('user')
          verbose_name_plural = _('users')
  
  
  
  class BusinessOwner(BaseUser):
      business_name=models.CharField(max_length=20)
  
  class Customer(BaseUser):
      address=models.CharField(max_length=30)
  
  class Staff(BaseUser):
      position=models.CharField(max_length=30)
  </code></pre>
  
  <p>my view.py</p>
  
  <pre><code>class CreateBusinessOwnerView(mixins.ListModelMixin,
                mixins.CreateModelMixin,
                generics.GenericAPIView):
      queryset = BusinessOwner.objects.all()
      serializer_class = CreateBusinessOwner
  
      def get(self, request, *args, **kwargs):
          return self.list(request, *args, **kwargs)
  
      def post(self, request, *args, **kwargs):
          return self.create(request, *args, **kwargs)
  
      def post_save(self, obj, created=False):
          if created:
              obj.set_password(obj.password)
              obj.save()
  </code></pre>
  
  <p>and my serializers.py</p>
  
  <pre><code>class CreateBusinessOwner(serializers.ModelSerializer):
      class Meta:
          model = BusinessOwner
          fields = ('email', 'password', 'first_name', 'last_name', 'business_name' ,'date_joined')
          read_only_fields = ('date_joined',)
  </code></pre>
  
  <p>Thanks for helping me!</p>