When to use UserPassesTestMixin vs PermissionRequiredMixin

• PermissionRequiredMixin: Verify that the current user has all specified permissions.

• UserPassesTestMixin: Deny a request with a permission error if the test_func() method returns False.

As the name suggests PermissionRequiredMixin only checks the permissions that are defined either in permission_required attribute or get_permission_required() method.

But, the UserPassesTestMixin is much generic version, which helps you to check any number of arbitrary conditions. For example, you can check the logged-in user's email domain, or any custom attributes, or values etc.

---

Example-1

In this example, both are equal.
from django.contrib.auth import mixins
from django.views import generic


class TestPermissionView(mixins.PermissionRequiredMixin, generic.CreateView):
    permission_required = [
        'foo.add_bar',
        'foo.change_bar'
    ]


class TestUserTestView(mixins.UserPassesTestMixin, generic.CreateView):
    def test_func(self):
        req_perms = [
            'foo.add_bar',
            'foo.change_bar'
        ]
        
        return self.request.user.has_perms(req_perms)

In this example, both classes behave in the same way

Example-2

class TestUserTestView(mixins.UserPassesTestMixin, generic.CreateView):
    def test_func(self):
        # this  checks the email domain of the user
        allowed_domains = ['foo.com', 'bar.co.in']
        return self.request.user.email.split('@')[1] in allowed_domains

In this example, we are checking the user's email domain. As you can see, this example can not be re-written using PermissionRequiredMixin class.

Test and Permission classes are not alternatives to each other.

You should use PermissionMixin for limiting users' actions. You may write your permission logic directly on view but that classes are the generic ways and recommended if you'll use it multiple times on the project.

And you may want to test it with a Test class. For make sure your code part works as wanted.