'POST' or 'PUT' or 'DELETE' is not working

Here the class WriteByAdminOnlyPermission is not working perfectly. This if request.method == 'GET': working but remaining condition is not working. My target is, only the admin can change information and the other people just can see. How can I do it? And where I did do wrong? please give me a relevant solution😥

Note: I used here custom User

class User(AbstractUser):
    id = models.CharField(primary_key=True, max_length=10, default=uuid.uuid4, editable=False)

    email = models.EmailField(max_length=50, unique=True, error_messages={"unique":"The email must be unique!"})
    REQUIRES_FIELDS = ["email"]
    objects = CustomeUserManager()

views.py:

class WriteByAdminOnlyPermission(BasePermission):
    def has_permission(self, request, view):
        user = request.user

        if request.method == 'GET':
            return True

        if request.method in['POST' or 'PUT' or 'DELETE'] and user.is_superuser:
            return True
        return False

class ScenarioViewSet(ModelViewSet):
    permission_classes=[WriteByAdminOnlyPermission]
    serializer_class = ScenarioSerializer
    queryset = Scenario.objects.all()

models.py:

class Scenario(models.Model):
    id = models.CharField(primary_key=True, max_length=10, default=uuid.uuid4, editable=False)
    Title = models.CharField(max_length=350, null=True, blank=False)
    film_id = models.OneToOneField(Film, on_delete=models.CASCADE, related_name="ScenarioFilmID", null=True)

serializer.py:

class ScenarioSerializer(ModelSerializer):
    class Meta:
        model = Scenario
        fields = "__all__"

urls.py:

router.register(r"scenario", views.ScenarioViewSet , basename="scenario")

Why you are using or operator in list, it can be simplified as ['POST', 'PUT', 'DELETE']so:

if request.method in ['POST', 'PUT', 'DELETE'] and user.is_superuser:

Edit

Try to use the IsAuthenticatedOrReadOnly class directly to allow unauthenticated users to perform GET requests and authenticated users to perform POST, PUT, and DELETE requests so:

from rest_framework.permissions import IsAuthenticatedOrReadOnly, BasePermission

class WriteByAdminOnlyPermission(BasePermission):
    def has_permission(self, request, view):
        user = request.user

        if request.method in ['POST', 'PUT', 'DELETE'] and user.is_superuser:
            return True        
        return IsAuthenticatedOrReadOnly().has_permission(request, view)

class ScenarioViewSet(ModelViewSet):
    permission_classes = [WriteByAdminOnlyPermission]
    serializer_class = ScenarioSerializer
    queryset = Scenario.objects.all()

As defined by you in the below comment as removing DEFAULT_AUTHENTICATION_CLASSES worked for you.