tomchristie/django-rest-framework — pull request #152 by mammique (2012-02-02 02:37:58+00:00)
Title: ModelMixin's lazy model_instance and IsModelInstanceOwnerOrIsAnonReadOnly permission

Instead of loading the ModelMixin's model_instance in the .get() .put() and .delete() functions, I moved it to a lazy (hits the DB only once) model_instance property. Then it can be called elsewhere, and earlier, such as the auth/permission phase, where the ability of accessing the model instance data can provide more granular checks.

As a first step (I'm preparing the implementation for OAuth 2.0) I've added a IsModelInstanceOwnerOrIsAnonReadOnly permission, which only allows write access to the model instance's owner (assuming the model implements a .get_owner() function). Based on this, we can implement a resource/instance authorization system between resource owners.