from rest_framework import permissions


class IsUserOrChris(permissions.BasePermission):
    """
    Custom permission to only allow the user or superuser
    'chris' to acces, modify/edit the user's information.
    """

    def has_object_permission(self, request, view, obj):
        # Read and write permissions are only allowed to
        # the owner and superuser 'chris'.
        return (obj.username == request.user.username) or (request.user.username == 'chris')



from rest_framework import permissions


class IsUserOrChrisOrReadOnly(permissions.BasePermission):
    """
    Custom permission to only allow owners of an object or superuser
    'chris' to modify/edit it. Read only is allowed to other users.
    """

    def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        if request.method in permissions.SAFE_METHODS:
            return True

        # Write permissions are only allowed to the authenticated user and
        # superuser 'chris'.
        return (obj == request.user) or (request.user.username == 'chris')



Remove IsUserOrChris and add IsUserOrChrisOrReadOnly permissions