(api) give update rights to domain viewer on own mailbox

Introduces the notion of self in permissions
allowing a domain viewer to update their own mailbox.
This commit is contained in:
Marie PUPO JEAMMET
2025-07-09 16:00:00 +02:00
committed by Marie
parent e45cf8dd8b
commit 72e73bff45
6 changed files with 126 additions and 67 deletions

View File

@@ -350,11 +350,13 @@ class Mailbox(AbstractBaseUser, BaseModel):
MailDomainRoleChoices.ADMIN,
]
is_self = self.get_email() == user.email
return {
"get": bool(role),
"post": is_owner_or_admin,
"patch": is_owner_or_admin,
"put": is_owner_or_admin,
"patch": is_owner_or_admin or is_self,
"put": is_owner_or_admin or is_self,
"delete": False,
}