сделал ограничение для метода list

server/proj/audio/views.py

@@ -3,7 +3,7 @@ from rest_framework.viewsets import ViewSet
 from rest_framework.response import Response
 from rest_framework.decorators import action
 from rest_framework import status
-from django.shortcuts import get_object_or_404
+from django.shortcuts import get_object_or_404, get_list_or_404
 from rest_framework.permissions import IsAuthenticated
 import requests
 
@@ -13,21 +13,15 @@ from .serializers import SongSerializer, FavoriteSongSerializer
 
 class SongViewSet(ViewSet):
     permission_classes_by_action = {
+        'list': [IsAuthenticated],
         'retrieve': [IsAuthenticated],
     }
     def list(self, request):
-        queryset = Song.objects.all()
-        serializer = SongSerializer(queryset, many=True)
+        user_pk = request.user.pk
+        queryset = get_list_or_404(FavoriteSong, user=user_pk)
+        serializer = FavoriteSongSerializer(queryset, many=True)
         return Response(serializer.data)
     
-    def get_permissions(self):
-        try:
-            # return permission_classes depending on `action` 
-            return [permission() for permission in self.permission_classes_by_action[self.action]]
-        except KeyError: 
-            # action is not set return default permission_classes
-            return [permission() for permission in self.permission_classes]
-    
     def retrieve(self, request, pk=None):
         user_pk = request.user.pk
         song_obj = get_object_or_404(Song, azura_id=pk).pk
@@ -76,8 +70,6 @@ class SongViewSet(ViewSet):
                 return Response(serializer_1.data, status=status.HTTP_201_CREATED)
             else:
                 return Response(serializer_1.errors, status=status.HTTP_400_BAD_REQUEST)
-                
-        
     
     @action(detail=False, methods=['post'], schema=DeleteSongSchema())
     def delete_song(self, request):
@@ -85,5 +77,11 @@ class SongViewSet(ViewSet):
         item = get_object_or_404(FavoriteSong, pk=song_id)
         item.delete()
         return Response(status=status.HTTP_202_ACCEPTED)
+    
+    def get_permissions(self):
+        try:
+            return [permission() for permission in self.permission_classes_by_action[self.action]]
+        except KeyError: 
+            return [permission() for permission in self.permission_classes]