tomchristie/django-rest-framework — pull request #1093 by bwreilly (2013-09-09 02:37:42+00:00)
Title: Object level permissions 

This pull introduces a `DjangoObjectLevelModelPermissions` permission backend and an `ObjectPermissionReaderFilter` filter backend. Adding these to a generic view will test object level permissions using `django-guardian` before allowing appropriate actions. This should satisfy issue https://github.com/tomchristie/django-rest-framework/issues/644

Example:

```python

class UserViewSet(viewsets.ModelViewSet):
model = User
permission_classes = (permissions.DjangoObjectLevelModelPermissions,)
```

Only users with `"read_user"` permission to a specific `User` object will be able to view that object (and correspondingly `change`, `delete` for those actions).

---

This is my first contribution, and it is somewhat sizable, so I could use some guidance on a couple of issues.

1. I created a Filter backend for limiting `list` results to users with `read` permission, which introduces a dependency into `permissions.py` for `filters.py`.

This could be avoided by either (1) not using a Filter, just filtering directly in the permission class or (2) requiring the user to specifically include the `ObjectPermissionReaderFilter` if they wanted that behavior.
2. The new object level permission backend requires some knowledge of the action attempting to be performed.

For a ViewSet this is simple as `action` is defined as part of dispatching. For other generics (including those I used to test), an action had to be provided explicitly.

It may be better to require the [object permission check in the generic views](https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/generics.py#L312) to pass what kind of action it needs to be checked