toastdriven/django-tastypie — comment on commit a4986212955ac177710ad7716e878ec23b631d21
File:  line 0
By toastdriven:

I'm not sure altering/duplicating ``apply_limits`` to the non-read types helps, since as you pointed out before, they aren't really using the ORM in those circumstances. I think doing the boolean check for those types makes the most sense.

As for the ``bundle`` getting passed to the ``authorized_to_*`` methods, it will almost always have an ``obj`` (only exceptions are the ``delete_list/detail`` & ``get_schema`` methods. Before it's in master, the ``delete_list/detail" will have it too, at the expense of not being quite as efficient). That ``bundle.obj`` may be unsaved (like in the case of ``POST``), but everything should at least be there for the user to check authorization on it.