caxap / rest_condition

Complex permissions flow for django-rest-framework (http://django-rest-framework.org).
MIT License
281 stars 29 forks source link

Combining has_permission with has_object_permission isn't working #11

Open ArtemBernatskyy opened 6 years ago

ArtemBernatskyy commented 6 years ago

Plz mention in docs that in order to achieve correct combining has_permission with has_object_permission We need to both override both has_object_permission and has_permission

For example

class OperatorPermission(permissions.BasePermission):
    """
        Allowing access to Operator only
    """

    def has_permission(self, request, view):
        return request.user.is_operator

    def has_object_permission(self, request, view, obj):
        return request.user.is_operator