37 lines
1.2 KiB
Python
37 lines
1.2 KiB
Python
|
"""Permission handlers for the impress core app."""
|
||
|
|
from rest_framework import permissions
|
||
|
|
|
||
|
|
ACTION_FOR_METHOD_TO_PERMISSION = {
|
||
|
|
"versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
class IsAuthenticated(permissions.BasePermission):
|
||
|
|
"""
|
||
|
|
Allows access only to authenticated users. Alternative method checking the presence
|
||
|
|
of the auth token to avoid hitting the database.
|
||
|
|
"""
|
||
|
|
|
||
|
|
def has_permission(self, request, view):
|
||
|
|
return bool(request.auth) or request.user.is_authenticated
|
||
|
|
|
||
|
|
|
||
|
|
class IsAuthenticatedOrSafe(IsAuthenticated):
|
||
|
|
"""Allows access to authenticated users (or anonymous users but only on safe methods)."""
|
||
|
|
|
||
|
|
def has_permission(self, request, view):
|
||
|
|
if request.method in permissions.SAFE_METHODS:
|
||
|
|
return True
|
||
|
|
return super().has_permission(request, view)
|
||
|
|
|
||
|
|
|
||
|
|
class IsSelf(IsAuthenticated):
|
||
|
|
"""
|
||
|
|
Allows access only to authenticated users. Alternative method checking the presence
|
||
|
|
of the auth token to avoid hitting the database.
|
||
|
|
"""
|
||
|
|
|
||
|
|
def has_object_permission(self, request, view, obj):
|
||
|
|
"""Write permissions are only allowed to the user itself."""
|
||
|
|
return obj == request.user
|