Merge work from sebpiq

1 files changed, 11 insertions, 37 deletions

diff --git a/djangorestframework/mixins.py b/djangorestframework/mixins.py
index f95ec60f..3142b093 100644
--- a/djangorestframework/mixins.py
+++ b/djangorestframework/mixins.py
@@ -3,7 +3,6 @@ The :mod:`mixins` module provides a set of reusable `mixin`
 classes that can be added to a `View`.
 """
 
-from django.contrib.auth.models import AnonymousUser
 from django.core.paginator import Paginator
 from django.db.models.fields.related import ForeignKey
 from urlobject import URLObject
@@ -19,7 +18,7 @@ __all__ = (
     # Base behavior mixins
     'RequestMixin',
     'ResponseMixin',
-    'AuthMixin',
+    'PermissionsMixin',
     'ResourceMixin',
     # Model behavior mixins
     'ReadModelMixin',
@@ -49,7 +48,7 @@ class RequestMixin(object):
         This new instance wraps the `request` passed as a parameter, and use
         the  parsers set on the view.
         """
-        return self.request_class(request, parsers=self.parsers)
+        return self.request_class(request, parsers=self.parsers, authentication=self.authentication)
 
     @property
     def _parsed_media_types(self):
@@ -101,57 +100,32 @@ class ResponseMixin(object):
         return self.renderers[0]
 
 
-########## Auth Mixin ##########
+########## Permissions Mixin ##########
 
-class AuthMixin(object):
+class PermissionsMixin(object):
     """
-    Simple :class:`mixin` class to add authentication and permission checking to a :class:`View` class.
+    Simple :class:`mixin` class to add permission checking to a :class:`View` class.
     """
 
-    authentication = ()
-    """
-    The set of authentication types that this view can handle.
-
-    Should be a tuple/list of classes as described in the :mod:`authentication` module.
-    """
-
-    permissions = ()
+    permissions_classes = ()
     """
     The set of permissions that will be enforced on this view.
 
     Should be a tuple/list of classes as described in the :mod:`permissions` module.
     """
 
-    @property
-    def user(self):
-        """
-        Returns the :obj:`user` for the current request, as determined by the set of
-        :class:`authentication` classes applied to the :class:`View`.
-        """
-        if not hasattr(self, '_user'):
-            self._user = self._authenticate()
-        return self._user
-
-    def _authenticate(self):
+    def get_permissions(self):
         """
-        Attempt to authenticate the request using each authentication class in turn.
-        Returns a ``User`` object, which may be ``AnonymousUser``.
+        Instantiates and returns the list of permissions that this view requires.
         """
-        for authentication_cls in self.authentication:
-            authentication = authentication_cls(self)
-            user = authentication.authenticate(self.request)
-            if user:
-                return user
-        return AnonymousUser()
+        return [p(self) for p in self.permissions_classes]
 
     # TODO: wrap this behavior around dispatch()
-    def _check_permissions(self):
+    def check_permissions(self, user):
         """
         Check user permissions and either raise an ``ImmediateResponse`` or return.
         """
-        user = self.user
-        for permission_cls in self.permissions:
-            permission = permission_cls(self)
+        for permission in self.get_permissions():
             permission.check_permission(user)