title: Django Rest Framework check_object_permissions not being called
body: <p>I am trying to make sure the user has permission to view the object they are calling. Here is my permissions class:</p>
  
  <pre><code>from rest_framework import permissions
  
  
  class IsOwner(permissions.BasePermission):
      """
      Custom permission to only allow owners of an object to do actions.
      """
      message = 'You must be the owner of this object.'
  
      def has_object_permission(self, request, view, obj):
          print("CHECK THAT I GOT HERE")
          return obj.user == request.user
  </code></pre>
  
  <p>And here is my ViewSet:</p>
  
  <pre><code>class TopLevelJobViewSet(ModelViewSet):
      permission_classes = (IsOwner,)
      serializer_class = TopLevelJobSerializer
      queryset = TopLevelJob.objects.all()
      filter_backends = [DjangoFilterBackend, RelatedOrderingFilter]
      filter_class = TopLevelJobFilter
      ordering_fields = '__all__'
  </code></pre>
  
  <p>The<code>has_object_permissions</code> is not being called, anyone visiting the endpoint is able to access all the objects.</p>
  
  <p>Why is this? How do I get <code>has_object_permissions</code> to get called?</p>
  
  <p>This post: <a href="https://stackoverflow.com/questions/22561698/django-rest-framework-ignores-has-object-permission">Django rest framework ignores has_object_permission</a> talks about it being an issue with not having <code>GenericAPIView</code>. But <code>ModelViewSet</code> has <code>GenericViewSet</code> which has <code>generics.GenericAPIView</code>. Is something overriding this somewhere?</p>
  
  <p>EDIT: My issue was that I was calling <code>list</code> instead of <code>get</code>. How can I only returns objects in <code>list</code> that belong to a user? </p>
  
  <p>This link: <a href="https://www.django-rest-framework.org/api-guide/filtering/#filtering-against-the-current-user" rel="nofollow noreferrer">https://www.django-rest-framework.org/api-guide/filtering/#filtering-against-the-current-user</a> shows I could implement something like this:</p>
  
  <pre><code>def get_queryset(self):
      username = self.kwargs['username']
      return Purchase.objects.filter(purchaser__username=username)
  </code></pre>
  
  <p>This seems to violate DRY if I have to add this to every viewset. Is there a way to turn this into a <code>permissions</code> class that I could always call?</p>