              assign_perm(app_label + delete, full_access, obj=model)
              (assign_perm(app_label + write, user, obj=model) for user in (writer, full_access))
              (assign_perm(app_label + read, user, obj=model) for user in (reader, writer, full_access))
  
              # object level permissions
              assign_perm(delete, full_access, obj=model)
              (assign_perm(write, user, obj=model) for user in (writer, full_access))
              (assign_perm(read, user, obj=model) for user in (reader, writer, full_access))
  
              self.no_permission_credentials = basic_auth_header('no_permission', 'password')
              self.reader_credentials = basic_auth_header('reader', 'password')
              self.writer_credentials = basic_auth_header('writer', 'password')
              self.full_access_credentials = basic_auth_header('full_access', 'password')
 
</s> remove             read = "read_basicpermmodel"
            write = "change_basicpermmodel"
            delete = "delete_basicpermmodel"
            app_label = 'tests.'
            # model level permissions
            assign_perm(app_label + delete, full_access, obj=model)
            (assign_perm(app_label + write, user, obj=model) for user in (writer, full_access))
            (assign_perm(app_label + read, user, obj=model) for user in (reader, writer, full_access))
 </s> add             model = BasicPermModel.objects.create(text='foo')
            
            assign_perm(perms['read'], readers, model)
            assign_perm(perms['change'], writers, model)
            assign_perm(perms['delete'], deleters, model)

            readers.user_set.add(users['fullaccess'], users['readonly'])
            writers.user_set.add(users['fullaccess'], users['writeonly'])
            deleters.user_set.add(users['fullaccess'], users['deleteonly'])

            self.credentials = {}
            for user in users.values():
                self.credentials[user.username] = basic_auth_header(user.username, 'password')

        # Delete
        def test_can_delete_permissions(self):
            request = factory.delete('/1', HTTP_AUTHORIZATION=self.credentials['deleteonly'])
            object_permissions_view.cls.action = 'destroy'
            response = object_permissions_view(request, pk='1')
            self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT) </s> remove             self.no_permission_credentials = basic_auth_header('no_permission', 'password')
            self.reader_credentials = basic_auth_header('reader', 'password')
            self.writer_credentials = basic_auth_header('writer', 'password')
            self.full_access_credentials = basic_auth_header('full_access', 'password')
 </s> add         # Update
        def test_can_update_permissions(self):
            request = factory.patch('/1', {'text': 'foobar'}, format='json',
                HTTP_AUTHORIZATION=self.credentials['writeonly'])
            object_permissions_view.cls.action = 'partial_update'
            response = object_permissions_view(request, pk='1')
            self.assertEqual(response.status_code, status.HTTP_200_OK)
            self.assertEqual(response.data.get('text'), 'foobar') </s> remove         def test_has_delete_permissions(self):
            request = factory.delete('/1', HTTP_AUTHORIZATION=self.full_access_credentials)
 </s> add         # Read
        def test_can_read_permissions(self):
            request = factory.get('/1', HTTP_AUTHORIZATION=self.credentials['readonly'])
            object_permissions_view.cls.action = 'retrieve' </s> remove             # create users
            User.objects.create_user('no_permission', 'no_permission@example.com', 'password')
            reader = User.objects.create_user('reader', 'reader@example.com', 'password')
            writer = User.objects.create_user('writer', 'writer@example.com', 'password')
            full_access = User.objects.create_user('full_access', 'full_access@example.com', 'password')
            
            model = BasicPermModel.objects.create(text='foo')
 </s> add             perms = self.perms
            users = self.users
        def test_cannot_delete_permissions(self):
            request = factory.delete('/1', HTTP_AUTHORIZATION=self.credentials['readonly'])
            object_permissions_view.cls.action = 'destroy'
            response = object_permissions_view(request, pk='1')
            self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
              assign_perm(app_label + delete, full_access, obj=model)
              (assign_perm(app_label + write, user, obj=model) for user in (writer, full_access))
              (assign_perm(app_label + read, user, obj=model) for user in (reader, writer, full_access))
  
        def test_cannot_delete_permissions(self):
            request = factory.delete('/1', HTTP_AUTHORIZATION=self.credentials['readonly'])
            object_permissions_view.cls.action = 'destroy'
            response = object_permissions_view(request, pk='1')
            self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
        def test_cannot_delete_permissions(self):
            request = factory.delete('/1', HTTP_AUTHORIZATION=self.credentials['readonly'])
            object_permissions_view.cls.action = 'destroy'
            response = object_permissions_view(request, pk='1')
            self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
        def test_cannot_delete_permissions(self):
            request = factory.delete('/1', HTTP_AUTHORIZATION=self.credentials['readonly'])
            object_permissions_view.cls.action = 'destroy'
            response = object_permissions_view(request, pk='1')
            self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
        def test_cannot_delete_permissions(self):
            request = factory.delete('/1', HTTP_AUTHORIZATION=self.credentials['readonly'])
            object_permissions_view.cls.action = 'destroy'
            response = object_permissions_view(request, pk='1')
            self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
  
              self.no_permission_credentials = basic_auth_header('no_permission', 'password')
              self.reader_credentials = basic_auth_header('reader', 'password')
              self.writer_credentials = basic_auth_header('writer', 'password')
              self.full_access_credentials = basic_auth_header('full_access', 'password')
keep keep keep keep replace replace replace replace keep keep keep keep keep
 first pass at object level permissions and tests 
rest_framework/tests/test_permissions.py