title: Django REST framework: using object-level permissions without model-level permissions
body: <p>I have a Django project with API based on the <a href="http://www.django-rest-framework.org/" rel="nofollow">Django REST framework</a>.</p>
  
  <p>Recently I've enabled object-level permissions with the use of <a href="https://github.com/django-guardian/django-guardian" rel="nofollow">django-guardian</a>. However I'm not using <a href="https://docs.djangoproject.com/en/1.9/topics/auth/default/#permissions-and-authorization" rel="nofollow">model-level permissions framework</a> in my project yet (and until this moment I didn't see any purpose to.)</p>
  
  <p>Now when I turn on <a href="http://www.django-rest-framework.org/api-guide/permissions/#djangoobjectpermissions" rel="nofollow">DjangoObjectPermissions</a> in my API viewset,</p>
  
  <pre><code>class PhotoViewSet(viewsets.ModelViewSet)
      permission_classes = (permissions.DjangoObjectPermissions,)
  </code></pre>
  
  <p>and make an update request to the endpoint for an object that has a proper "change" permission from the Guardian framework, I get a <code>403 FORBIDDEN</code> response.</p>
  
  <p>The reason for this response appears to lay in a <a href="https://github.com/tomchristie/django-rest-framework/blob/18cdfcd712a5641cd43bd1dfa3715c5f6659d74c/rest_framework/views.py#L377" rel="nofollow">request dispatch stage</a>:</p>
  
  <ol>
  <li>DRF checks model permissions in this case.</li>
  <li><code>DjangoObjectPermissions</code> inherits from <code>DjangoModelPermissions</code>.</li>
  <li>DRF calls <code>DjangoObjectPermissions.has_permission()</code></li>
  <li><code>has_permission()</code> fails because I'm not using model-level permissions.</li>
  </ol>
  
  <p>What is a proper way to use <code>DjangoObjectPermissions</code> in my case?</p>
  
  <ul>
  <li>(A) Implement a custom permission class, inherit it from <code>DjangoObjectPermissions</code> and override <code>has_permission()</code>.</li>
  <li>(B) Turn the Django's model-level permission framework on just for the sake of it.</li>
  <li>(C) Use this <s>hack</s> <a href="https://github.com/tomchristie/django-rest-framework/blob/18cdfcd712a5641cd43bd1dfa3715c5f6659d74c/rest_framework/permissions.py#L112" rel="nofollow">workaround</a> to skip the check.</li>
  </ul>