06 DRD AuthZ

https://q1mi.github.io/Django-REST-framework-documentation/tutorial/4-authentication-and-permissions_zh/#_4

class ListUser(ListAPIView):
    serializer_class = common_serializers.UserSerializer
    permission_classes = [IsAuthenticated, IsParentUser]
    def get_queryset(self):
        user = self.request.user
        return [user_profile.user for user_profile in user.children.all()]