has_object_permission根本没有在（（object）-detail`）URL中被调用

Question

I have a problem in that has_object_permission() gets ignored. Even when I access http://127.0.0.1:8000/portfolios/3/ with the correct user logged in, it still defaults to has_permission() . Am I doing something wrong?

ViewSet class:

class PortfolioViewSet(viewsets.ModelViewSet):
    queryset = Portfolio.objects.all()
    serializer_class = serializers.PortfolioSerializer
    permission_classes = (permissions.IsPortfolioOwner, )

Permission Class:

class IsPortfolioOwner(permissions.BasePermission):

    # Details
    def has_object_permission(self, request, view, obj):
        print("Checking for object")

        ruser = request.user
        if ruser is None:
            return False
        elif ruser == obj.client.user:
            return True

    def has_permission(self, request, view):
        print("Checking for list")
        return request.user.is_superuser

Answer 1

In order for has_object_permission to be checked, has_permission must return True . If it returns False , then permission checks will short-circuit and the request will be denied.

Your current permission class will only allow the user to view the list if they are a superuser. And an individual object cannot be viewed under they are a superuser and viewing the current user's object.