Views decorators ordering

[fdevillard]

The views decorators' order matters. Indeed,

    @api_view(['GET'])
    @permission_classes([IsAuthenticated])
    def my_view(request):
        pass

is different from:

    @permission_classes([IsAuthenticated])
    @api_view(['GET'])
    def my_view(request):
        pass

This is clearly stated in the documentation (https://www.django-rest-framework.org/api-guide/views/#api-policy-decorators). Nevertheless, I find it easy to miss and it may have security implication too.

Shouldn't the latter throw an exception, as it may have security implication? If not, is anyone aware of a linter to avoid such error?

If needed, I've created a repo to illustrate this: https://github.com/fdevillard/drf-decorator-ordering-demo

Thanks ! :)