Permissions & Throttling

# Custom permission
# from rest_framework.permissions import BasePermission

# class IsAuthorOrReadOnly(BasePermission):
#     def has_object_permission(self, request, view, obj):
#         if request.method in ['GET', 'HEAD', 'OPTIONS']:
#             return True
#         return obj.author == request.user

# Usage in ViewSet
# class PostViewSet(viewsets.ModelViewSet):
#     permission_classes = [IsAuthenticatedOrReadOnly, IsAuthorOrReadOnly]

# Throttling — rate limiting
# settings.py
# REST_FRAMEWORK = {
#     'DEFAULT_THROTTLE_CLASSES': [
#         'rest_framework.throttling.AnonRateThrottle',
#         'rest_framework.throttling.UserRateThrottle',
#     ],
#     'DEFAULT_THROTTLE_RATES': {
#         'anon': '100/hour',     # Anonymous users
#         'user': '1000/hour',    # Authenticated users
#     },
# }

# Custom throttle per view
# from rest_framework.throttling import UserRateThrottle
# class BurstRateThrottle(UserRateThrottle):
#     rate = '5/minute'
# class PostCreateView(generics.CreateAPIView):
#     throttle_classes = [BurstRateThrottle]