title: Permission checks in DRF viewsets are not working right
body: <p>I am implementing an API where I have nested structures.</p>
  <p>Lets say it is a zoo and I can call <code>GET /api/cage/</code> to get a list of cages <code>GET /api/cage/1/</code> to get cage ID 1, but then I can <code>GET /api/cage/1/animals/</code> to get a list of animals in that cage.</p>
  <p>The problem I am having is with permissions. I should only be able to see animals in the cage if I can see the cage itself. I should be able to see the cage itself if <code>has_object_permission()</code> returns <code>True</code> in the relevant permission class.</p>
  <p>For some reason, <code>has_object_permission()</code> gets called when I do GET <code>/api/cage/1/</code>, but <code>has_permission()</code> gets called when I call <code>GET /api/cage/1/animals/</code>. And with <code>has_permission()</code> I don't have access to the object to check the permissions. Am I missing something? How do I do this?</p>
  <p>My cage viewset looks more or less like this</p>
  <pre class="lang-py prettyprint-override"><code>class CageViewSet(ModelViewSet):
      queryset = Cage.objects.all()
      serializer_class = CageSerializer
      permission_classes = [GeneralZooPermissions, ]
      authentication_classes = [ZooTicketCheck, ]
  
      def get_queryset(self):
          ... code to only list cages you have permission to see ...
  
      @detail_route(methods=['GET'])
      def animals(self, request, pk=None):
          return Request(AnimalSerializer(Animal.objects.filter(cage_id=pk), many=True).data)
  </code></pre>
  <p>My <code>GeneralZooPermissions</code> class looks like this (at the moment)</p>
  <pre class="lang-py prettyprint-override"><code>class GeneralZooPermissions(BasePermission):
      def has_permission(self, request, view):
          return True
  
      def has_object_permission(self, request, view, obj):
          return request.user.has_perm('view_cage', obj)
  </code></pre>
  <p>It seems like this is a bug in DRF. Detailed routes do not call the correct permission check. I have tried reporting this issue to DRF devs, but my report seems to have disappeared. Not sure what to do next. Ideas?</p>
  <p>The issue I posted with DRF is back and I got a response. Seems like checking only <code>has_permission()</code> and not <code>has_object_permission()</code> is the intended behavior. This doesn't help me. At this point, something like this would have to be done:</p>
  <pre class="lang-py prettyprint-override"><code>class CustomPermission(BasePermission):
      def has_permission(self, request, view):
          &quot;&quot;&quot;we need to do all permission checking here, since has_object_permission() is not guaranteed to be called&quot;&quot;&quot;
          if 'pk' in view.kwargs and view.kwargs['pk']:
              obj = view.get_queryset()[0]
              # check object permissions here
          else:
              # check model permissions here
  
      def has_object_permission(self, request, view, obj):
          &quot;&quot;&quot; nothing to do here, we already checked everything &quot;&quot;&quot;
          return True
  </code></pre>