detail_route on viewset not following object level permissions - django-rest-framework

Question

This is my ViewSet:
class PageViewSet(viewsets.ModelViewSet):
queryset = Page.objects.all()
serializer_class = PageSerializer
permission_classes = (IsAuthenticated, IsOwnerOrReadOnly,)
def perform_create(self, serializer):
serializer.save(owner=self.request.user, location=self.request.user.userextended.location)
#detail_route(methods=['post'])
def add(self, request, pk=None):
try:
page = Page.objects.get(pk=pk)
except:
content = {'Page': ['The page you are trying to add no longer exists.']}
return Response(content, status=status.HTTP_400_BAD_REQUEST)
page.users.add(request.user)
return Response(status=status.HTTP_204_NO_CONTENT)
And this is my IsOwnerOrReadOnly permission:
class IsOwnerOrReadOnly(permissions.BasePermission):
"""
Allow only the owner (and admin) of the object to make changes (i.e.
do PUT, PATCH, DELETE and POST requests. A user is an
owner of an object if the object has an attribute
called owner and owner is == request.user. If the
object is a User object or if the object does not have
an owner attribute, then return object == request.user.
"""
def has_permission(self, request, view):
print('In permission')
return True
def has_object_permission(self, request, view, obj):
print('In object level permission')
if request.method in permissions.SAFE_METHODS:
return True
if request.user.is_staff:
return True
try:
return obj.owner == request.user
except: # if obj does not have an owner property (e.g. users don't
# have owner properties).
return obj == request.user
The problem is, I can post to add-detail as an authenticated user even when I am not the owner of the page. When I do the post request, it only prints In permission twice and never prints In object level permission. My question is, since it is a detail_route and is clearly using a {lookup} object (see here which shows that it is using an object: http://www.django-rest-framework.org/api-guide/routers/), how come the has_object_permission() function from the permission class does not get called? How come only the regular has_permission() function gets called?
I'm hoping for someone to link to a documentation which verifies that even for detail_route, only has_permission gets called.
Edit: This is not a duplicate of Django rest framework ignores has_object_permission because I am using a ModelViewSet which inherits from GenericAPIView (as mentioned in the documentation: http://www.django-rest-framework.org/api-guide/viewsets/#modelviewset).

Answer 1

See this answer. There are some differences but the point is the same: check_object_permissions is not called.
Although you are inheriting from ModelViewSet you are not using its get_object in your add method to retrieve the page. It is get_object that calls check_object_permissions (not the router) for retrieve, update etc., so obviously it doesn't get called.
To fix it, do the following:
class PageViewSet(viewsets.ModelViewSet):
# ...
#detail_route(methods=['post'])
def add(self, request, pk=None):
page = self.get_object()
page.users.add(request.user)
return Response(status=status.HTTP_204_NO_CONTENT)
or just do self.check_object_permissions(page) yourself somewhere in your implementation.