I don't understand this permission check (I don't really know DRF TBH BTW)