Setting the file. One moment.
Skill 10 · Django Access Review
Subchapter 10.3
references/drf-permissions.mdMarkdown2 KBView on GitHub
Background on how DRF handles permissions. Use this to understand what you’re seeing, not as patterns to match.
Request → permission_classes.has_permission() → View method → get_object() → has_object_permission()self.get_object() is calledCritical: If a view does Model.objects.get(pk=pk) directly instead of self.get_object(), the has_object_permission() is NEVER called.
# settings.py
REST_FRAMEWORK = {
'DEFAULT_PERMISSION_CLASSES': [...]
}This applies to ALL views unless overridden.
Don’t assume from the name. Read the class:
# IsAuthenticated only checks login, not ownership
# DjangoModelPermissions checks model-level perms, not object-level
# Custom classes - read the implementation# Uses get_object() - permissions apply
instance = self.get_object()
# Direct query - permissions DON'T apply
instance = Model.objects.get(pk=pk)This determines what objects are even reachable:
def get_queryset(self):
return Model.objects.all() # Everything
return Model.objects.filter(owner=self.request.user) # ScopedSerializers control what fields are readable/writable:
class Meta:
fields = '__all__' # What's included?
read_only_fields = [...] # What can't be set?Key question: Can the client set the owner field, or is it server-controlled?