{"action":"opened","issue":{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3220","labels_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3220/labels{/name}","comments_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3220/comments","events_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3220/events","html_url":"https://github.com/tomchristie/django-rest-framework/issues/3220","id":99126854,"number":3220,"title":"Feature: Add a third method for permissions classes (has_list_permissions)","user":{"login":"ralmidani","id":2768886,"avatar_url":"https://avatars.githubusercontent.com/u/2768886?v=3","gravatar_id":"","url":"https://api.github.com/users/ralmidani","html_url":"https://github.com/ralmidani","followers_url":"https://api.github.com/users/ralmidani/followers","following_url":"https://api.github.com/users/ralmidani/following{/other_user}","gists_url":"https://api.github.com/users/ralmidani/gists{/gist_id}","starred_url":"https://api.github.com/users/ralmidani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ralmidani/subscriptions","organizations_url":"https://api.github.com/users/ralmidani/orgs","repos_url":"https://api.github.com/users/ralmidani/repos","events_url":"https://api.github.com/users/ralmidani/events{/privacy}","received_events_url":"https://api.github.com/users/ralmidani/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-08-05T05:45:18Z","updated_at":"2015-08-05T05:45:18Z","closed_at":null,"body":"Real use case: An HR app.\r\n\r\nI want only admin users to be able to see a list of all employees, and employees to only be able to see their own employee object.\r\n\r\nHere is my current code:\r\n\r\n```python\r\nfrom rest_framework import permissions\r\n\r\nclass IsEmployeeOrIsAdmin(permissions.BasePermission):\r\n    \r\n    def has_permission(self, request, view):\r\n        return request.user.is_staff\r\n        \r\n    def has_object_permission(self, request, view, obj):\r\n        return request.user.is_staff or request.user == obj.user\r\n```\r\n\r\nThe problem with the above is `has_permission()` always runs. If I keep it, users will not be able to see their own info. If I remove it, they will be able to see a list of all employees.\r\n\r\nThe `has_object_permissions()` method was [added in DRF 2.2](https://web.archive.org/web/20140708014856/http://django-rest-framework.readthedocs.org/en/latest/topics/2.2-announcement.html#simpler-object-level-permissions) to eliminate the need to check for an `obj` argument.\r\n\r\nI propose allowing the implementation of a `has_list_permission()` method which only runs when requesting a list of all objects. This would allow more flexible permissions systems without having to define custom behavior in the `View` or `ViewSet`.\r\n\r\nI tried filtering in the `get_queryset()` method, but when requesting another `Employee` as a non-admin I would get the status HTTP_404_NOT_FOUND, which is not the proper status for a forbidden request."}}