DELETE request only indicates, that the user wants delete, doesn't deletes the instance

recircle/instance/migrations/0003_auto_20200408_1503.py

+# Generated by Django 3.0.4 on 2020-04-08 13:03
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('image', '0001_initial'),
+        ('instance', '0002_instance_template'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='instance',
+            name='owner',
+        ),
+        migrations.AlterField(
+            model_name='instance',
+            name='disks',
+            field=models.ManyToManyField(blank=True, help_text='Disks attached to instance', related_name='instance', to='image.Disk', verbose_name='disks'),
+        ),
+    ]

recircle/instance/models.py

@@ -171,11 +171,10 @@ class Instance(BaseMachineDescriptor):
                                  on_delete=models.DO_NOTHING)
 
     disks = models.ManyToManyField(Disk, related_name="instance",
+                                   blank=True,
                                    help_text="Disks attached to instance",
                                    verbose_name="disks")
 
-    owner = models.ForeignKey(User, on_delete=models.CASCADE, null=True)
-
     @classmethod
     def create(cls, lease, owner, flavor, template, remote_id, params):
         params["password"] = cls.generate_password()
@@ -272,3 +271,7 @@ class Instance(BaseMachineDescriptor):
     def change_description(self, new_description):
         self.description = new_description
         self.save()
+
+    def destroy(self):
+        self.deleted = True
+        self.save()

recircle/instance/views.py

@@ -62,7 +62,8 @@ class InstanceViewSet(AuthorizationMixin, ViewSet):
             raise Http404
 
     def list(self, request):
-        instances = self.get_objects_with_perms(request.user, "list", Instance)
+        # instances = self.get_objects_with_perms(request.user, "list", Instance)
+        instances = Instance.objects.filter(Q(created_by=request.user) & Q(deleted=False))
         return Response(InstanceListItemSerializer(instances, many=True).data)
 
     def create(self, request):
@@ -114,14 +115,11 @@ class InstanceViewSet(AuthorizationMixin, ViewSet):
             instance.change_description(request.data["description"])
         return Response(InstanceSerializer(instance).data)
 
-    def destroy(self, request, pk, format=None):
+    def destroy(self, request, pk):
         instance = self.get_object(pk)
         if not instance:
             return Response(status=status.HTTP_204_NO_CONTENT)
-        if not self.has_perms_for_object(request.user, 'destroy', instance):
-            return Response({"error": "No permission to destroy the Virtual Machine."},
-                            status=status.HTTP_401_UNAUTHORIZED)
-        instance.delete()
+        instance.destroy()
         return Response(status=status.HTTP_204_NO_CONTENT)
 
     @action(detail=True, methods=["post"])
@@ -182,10 +180,12 @@ class InstanceViewSet(AuthorizationMixin, ViewSet):
 
     @action(detail=True, methods=["POST"])
     def attach_disk(self, request, pk):
+        # TODO: attach not implemented in model
         pass
 
     @action(detail=True, methods=["POST"])
     def detach_disk(self, request, pk):
+        # TODO: attach not implemented in model
         pass
 
     @action(detail=True, methods=["POST"])