Permission classes should have a has_user_permission
data['permissions'] += permissions.AnonymousReadOnly.anonymous_perms
elif self.context['request'].user.is_authenticated:
if hasattr(obj._meta, 'auto_author'):
data['permissions'] += permissions.AnonymousReadOnly.author_perms
else:
data['permissions'] += permissions.AnonymousReadOnly.authenticated_perms
This code should be in a method of the permission class, so that it can be overriden.