Django Rest Framework--deny access to list but not to retrieve
One of the arguments to has_permission is view, which has an attribute .action, which is one of the five "LCRUD" actions ("list"/"create"/"retrieve"/"update"/"destroy").  So I think you could use that to check, in has_permission, whether the action being performed is a list or a retrieve, and deny or allow it accordingly.
I'm using Django Rest Framework and I'm having some trouble with permissions.  I know how to use has_permission and has_object_permission, but I have a number of cases where someone needs to be able to access retrieve but not list--e.g., a user has access to their own profile, but not to the full list of them.  The problem is, has_permission is always called before has_object_permission, so has_object_permission can only be more restrictive, not less.
So far, the only way I've been able to do this is to have more permissive permissions and then overwrite list() directly in the ViewSet and include the permission check in the logic, but I'd be able to actually store all of this logic in a Permissions class rather than in each individual viewset.
Is there any way to do this?  Right now I feel like I'm goign to have to write a ViewSet metaclass to automatically apply permissions as I want to each viewset method, which isn't really something I want to do.