title: How can I do the Unit testing of these custom permissions in my Django/Django REST project?
body: <p>everyone. I hope you're doing well. I'm a Django newbie, trying to learn the basics of RESTful development. I only know Python, so this is my best fit for the moment.</p>
  <p>Right now I'm trying to implement Unit tests for my API. It's a simple model to implement CRUD on the names and heights of NBA players. In my models I added a class to describe this data and translated it to a view with ModelViewSets. I wanted to make this data editable only for a specific type of user (a read-write user), only readable for another (read-only user) as well as unaccesible to non-authenticated users. To do so, I created a custom User Model and translated it to my views with a custom permission. Now I want to write a few Unit tests to check that:</p>
  <ol>
  <li>r/w user can create a new player</li>
  <li>r/w user can get a list of players</li>
  <li>r/o user cannot create a new player</li>
  <li>r/o user can get a list of players</li>
  <li>unauthenticated user cannot create a new player</li>
  <li>unauthenticated user cannot get a list of players</li>
  </ol>
  <p>Here is my <code>models.py</code>:</p>
  <pre><code>from django.db import models
  from django.contrib.auth.models import AbstractUser
  
  class User(AbstractUser):
      ROLES = [('read-only', 'read-only'), ('read-write', 'read-write'),]
      role = models.CharField(max_length=32, choices=ROLES, default='read-only')
  # Create your models here.
  class NBAplayers(models.Model):
      first_name = models.CharField(max_length=100)
      h_in = models.DecimalField(max_digits=5, decimal_places=2)
      h_meters = models.DecimalField(max_digits=5, decimal_places=2)
      last_name = models.CharField(max_length=120)
  
      def __str__(self):
          return self.first_name
  </code></pre>
  <p>And my <code>views.py</code>:</p>
  <pre><code>from .models import NBAplayers, User
  from .serializers import NBAplayersSerializer
  from rest_framework.response import Response
  from rest_framework import status, viewsets, permissions
  
  class ReadOnlyPermission(permissions.BasePermission):
  
      def has_permission(self, request, view):
          requests = ('POST', 'PUT', 'DELETE', 'PATCH')
          user = request.user
          role = User.role
          if user.is_anonymous:  # Not Authenticated
              return request.method == 'GET'            
          else:    
              if role == 'read-write':
                  return request.method in requests + ('GET',)
              else:  # Read Only User
                  return request.method == 'GET'
  
  class NBAPlayersViewSet(viewsets.ModelViewSet):
      serializer_class = NBAplayersSerializer
      queryset = NBAplayers.objects.all()
      permission_classes = [ReadOnlyPermission] 
  </code></pre>
  <p>And Finally, my <code>urls.py</code>:</p>
  <pre><code>from django.contrib import admin
  from django.urls import path, include
  from .views import  NBAPlayersViewSet
  from rest_framework.routers import DefaultRouter
  
  router = DefaultRouter()
  router.register('players', NBAPlayersViewSet, basename = 'Players list')
  
  
  urlpatterns = [
      #djoser basic authentication
      #Routers URLs
      path('', include(router.urls)),
      path('players/&lt;int:pk&gt;/', include(router.urls)),
      path('', include('djoser.urls')),
      path('', include('djoser.urls.authtoken')),
  ]
  </code></pre>
  <p>All the code above required to add the custom user to the global settings with <code>AUTH_USER_MODEL = 'api_basic.User'</code>. So, I've read the documentation and watched a few videos trying to understand how to write the proper tests, but the examples are not that close to this problem. I wanted to ask for a few pointers in the right direction, so that I can use it to build the rest of the tests. This is my first time writing unit tests.</p>
  <p>Thank you beforehand for any help or input you can give. Cheers!</p>