Should "has_object_permission" call "has_permission" as default instead of returning always "True"?

[Cloves23]

Hi, there.

Short description: The method BasePermission.has_object_permission is returning a inconsistent value.

I was trying to implement a more complex permission check using custom permissions and noticed an inconsistency in the final result. In my case, I have a permission that checks for specific action names and then verifies the user type. The problem occurs when I need to verify object-level permissions. While 'has_permission' returns 'False', 'has_object_permission' returns 'True'. For consistency, wouldn't it be correct to call has_object_permission by default?

My code:

from rest_framework import permissions

@perm_with_attrs("action")
class IsAction(permissions.BasePermission):
    code = "action_not_allowed"
    message = _("Action is not allowed.")
    action: str

    def has_permission(self, request, view):
        return view.action == self.action

high_privileges = ~IsAction("cancel_account") & (
    IsAdminUser | IsTrainerUser | HasDjangoPermission(Customer, ["view"])
)

How I solved it:

from rest_framework import permissions

class BasePermission(permissions.BasePermission):
    def has_permission(self, request, view):
        return True

    def has_object_permission(self, request, view, obj):
        return self.has_permission(request, view)

@perm_with_attrs("action")
class IsAction(BasePermission):
    ...

How to reproduce

from collections import namedtuple
from rest_framework.permissions import IsAdminUser

User = namedtuple("User", "is_staff")
Request = namedtuple("Request", "user")

req_user = Request(User(False))
assert IsAdminUser().has_permission(req_user, None) is False
assert IsAdminUser().has_object_permission(req_user, None, None) is False  # Break
assert (~IsAdminUser)().has_permission(req_user, None) is True
assert (~IsAdminUser)().has_object_permission(req_user, None, None) is True  # Break

req_staff = Request(User(True))
assert IsAdminUser().has_permission(req_staff, None) is True
assert IsAdminUser().has_object_permission(req_staff, None, None) is True
assert (~IsAdminUser)().has_permission(req_staff, None) is False
assert (~IsAdminUser)().has_object_permission(req_staff, None, None) is False