toastdriven/django-tastypie — comment on commit a4986212955ac177710ad7716e878ec23b631d21
File:  line 0
By gingerlime:

From a rather shallow look through the changes it looks good. I like the approach you took separating different actions into different authorization methods. The only thing I'm not too sure about is whether it's possible/sensible to do something similar with `apply_limits`, but I guess that getting the authorization foundation first (i.e. authorized / not-authorized binary decisions) is more important. To use some clever `apply_limits` can still happen on the user app if they want to.

One thing I couldn't quite work out (hope it's not a dumb question) - when you, for example, call `authorized_to_change` and pass in the bundle, the bundle does not actually include the object, i.e. `bundle.obj` is None. I'm guessing it's safer not to hydrate the object before the authorization decision is made, but wouldn't it make it difficult to do a row-level authorization without the actual object? (or the user app needs to effectively hydrate the object)??