from rest_framework.permissions import SAFE_METHODS, BasePermission class HasObjectPermission(BasePermission): def has_object_permission(self, request, view, obj): return obj.has_permission(request.user) class MemberHasOwnerPermission(BasePermission): def has_object_permission(self, request, view, obj): if request.method not in SAFE_METHODS and not request.user.own_organization: return False return obj.has_permission(request.user)