Currently permission classes seem to be geared towards a RBAC authorization scheme.
The permission classes defined for a resolver are run before the result of the resolver is available, i.e. the source object is None for the initial permission check. The source object is only available when checking permissions for fields of the source object. This makes it difficult to check for the ownership of the initial object, based on username or id for example.
It would be useful if the permission classes could implement permission checks for both before and after the resolver has been run and the result is available.
How does funding with Polar work?
Pay now to fund the work behind this issue.
Get updates on progress being made.
Maintainer is rewarded once the issue is completed.
Backer
You're funding impactful open source efforts
Contributor
You want to contribute to this effort
Maintainer
You want to get funding like this too