diff --git a/rest_framework_json_api/views.py b/rest_framework_json_api/views.py index f8766bc4..5237ccf7 100644 --- a/rest_framework_json_api/views.py +++ b/rest_framework_json_api/views.py @@ -108,6 +108,8 @@ class RelatedMixin(object): This mixin handles all related entities, whose Serializers are declared in "related_serializers" """ + related_permission_classes = {} + def retrieve_related(self, request, *args, **kwargs): serializer_kwargs = {} instance = self.get_related_instance() @@ -164,13 +166,23 @@ def get_related_instance(self): field = parent_serializer.fields.get(field_name, None) if field is not None: - return field.get_attribute(parent_obj) + result = field.get_attribute(parent_obj) else: try: - return getattr(parent_obj, field_name) + result = getattr(parent_obj, field_name) except AttributeError: raise NotFound + self.check_related_object_permissions(field_name, result) + return result + + def check_related_object_permissions(self, field_name, related_object): + for permission in self.related_permission_classes.get(field_name, []): + if not permission().has_object_permission(self.request, self, related_object): + self.permission_denied( + self.request, message=getattr(permission, 'message', None) + ) + class ModelViewSet(AutoPrefetchMixin, PrefetchForIncludesHelperMixin,