Список прав пользователей

class UserInfoSerializer(serializers.ModelSerializer):
    permissions = serializers.SerializerMethodField()

    class Meta:
        model = User
        fields = (... , 'permissions')

    def get_permissions(self, obj):
        return {
            i.codename: i.name for i in Permission.objects.filter(group__user=obj)
        }