has_object_permission doesn't get called about rest_condition HOT 1 OPEN

You will find that the outer Or is evaluating to True and short circuiting (not evaluating the second argument) because And(IsReadOnlyRequest, IsAuthenticated).has_object_permission returns True.

This is because IsReadOnlyRequest and IsAuthenticated both inherit from BasePermission which just returns True for has_object_permission. This is a gotcha when combining permissions with an or, which doesn't normally happen with the default DRF behavior.

To get your desired behavior, you will need to subclass IsReadOnlyRequest and IsAuthenticated so that their has_object_permission returns a meaningful result. I normally just do this:

class IsAuthenticated(permissions.IsAuthenticated):
    def has_object_permission(self, request, view, obj):
        return self.has_permission(request, view)

from rest_condition.