"""Custom permissions for Flow API."""
from __future__ import absolute_import, division, print_function, unicode_literals

from rest_framework import permissions


class ResolwePermissions(permissions.DjangoObjectPermissions):
    """Resolwe Permissions."""

    perms_map = {
        'GET': ['%(app_label)s.view_%(model_name)s'],
        'OPTIONS': ['%(app_label)s.view_%(model_name)s'],
        'HEAD': ['%(app_label)s.view_%(model_name)s'],
        'POST': ['%(app_label)s.edit_%(model_name)s'],
        'PUT': ['%(app_label)s.edit_%(model_name)s'],
        'PATCH': ['%(app_label)s.edit_%(model_name)s'],
        'DELETE': ['%(app_label)s.edit_%(model_name)s'],
    }

    def has_permission(self, request, view):
        """Return `True` as we don't use model level perms."""
        return True

    def has_object_permission(self, request, view, obj):
        """Check object permissions."""
        # admins can do anything
        if request.user.is_superuser:
            return True

        # `share` permission is required for editing permissions
        if 'permissions' in view.action:
            self.perms_map['POST'] = ['%(app_label)s.share_%(model_name)s']

        if view.action in ['add_data', 'remove_data']:
            self.perms_map['POST'] = ['%(app_label)s.add_%(model_name)s']

        return super(ResolwePermissions, self).has_object_permission(request, view, obj)

@@ -116,16 +116,49 @@
 terals%0A%0A
+from django.http import Http404%0A%0A
 from res
@@ -188,16 +188,16 @@
 issions%0A
-
 %0A%0Aclass 
@@ -1346,50 +1346,444 @@
     
-return super(ResolwePermissions, self).has
+if hasattr(view, 'get_queryset'):%0A            queryset = view.get_queryset()%0A        else:%0A            queryset = getattr(view, 'queryset', None)%0A%0A        assert queryset is not None, (%0A            'Cannot apply DjangoObjectPermissions on a view that '%0A            'does not set %60.queryset%60 or have a %60.get_queryset()%60 method.'%0A        )%0A%0A        model_cls = queryset.model%0A        user = request.user%0A%0A        perms = self.get_required
 _obj
@@ -1800,16 +1800,17 @@
 sion
+s
 (request
 , vi
@@ -1805,21 +1805,703 @@
 (request
-, view, obj)
+.method, model_cls)%0A%0A        if not user.has_perms(perms, obj):%0A            # If the user does not have permissions we need to determine if%0A            # they have read permissions to see 403, or not, and simply see%0A            # a 404 response.%0A%0A            if request.method in permissions.SAFE_METHODS:%0A                # Read permissions already checked and failed, no need%0A                # to make another lookup.%0A                raise Http404%0A%0A            read_perms = self.get_required_object_permissions('GET', model_cls)%0A            if not user.has_perms(read_perms, obj):%0A                raise Http404%0A%0A            # Has read permissions.%0A            return False%0A%0A        return True
 %0A

Copy has_object_permission function instead of calling super