debug: add logging to comments API and permissions

Add detailed logging to help debug why comments requests fail with 403

backend/api/v1/requests_app/permissions.py

@@ -123,16 +123,45 @@ class CommentsPermission(BasePermission):
         return False
 
     def has_object_permission(self, request: Request, view: Any, obj: Any) -> bool:
+        import logging
+        logger = logging.getLogger(__name__)
+        
         user = request.user
+        
+        # Логируем начало проверки
+        logger.info(
+            f"[CommentsPermission] Проверка доступа: "
+            f"user={user.id}, request_id={getattr(obj, 'id', '?')}, "
+            f"method={request.method}"
+        )
+        
         if getattr(user, "is_staff", False) or getattr(user, "is_superuser", False):
+            logger.info(f"[CommentsPermission] ✅ Доступ разрешен: staff/superuser")
             return True
+            
         # Участник заявки (владелец, получатель, cc, approver)
         if self._is_participant(user, obj):
+            logger.info(f"[CommentsPermission] ✅ Доступ разрешен: участник заявки")
             return True
+            
         if self._is_head_for_request(user, obj):
+            logger.info(f"[CommentsPermission] ✅ Доступ разрешен: head отдела")
             return True
+            
         code = self._required_perm(request)
-        return bool(code and user.has_perm(code))
+        has_perm = bool(code and user.has_perm(code))
+        logger.info(
+            f"[CommentsPermission] Проверка модельных прав: "
+            f"perm={code}, has_perm={has_perm}"
+        )
+        
+        if not has_perm:
+            logger.warning(
+                f"[CommentsPermission] ❌ Доступ запрещен: "
+                f"user={user.id}, request_id={getattr(obj, 'id', '?')}"
+            )
+        
+        return has_perm
 
 
 class NotFinalOrStaff(BasePermission):

backend/api/v1/requests_app/views.py

@@ -341,20 +341,30 @@ class RequestViewSet(viewsets.ModelViewSet):
         GET: список комментариев (staff, владелец или право view_requestcomment).
         POST: создание {"text": "..."} (staff, владелец или право add_requestcomment).
         """
+        import logging
+        logger = logging.getLogger(__name__)
+        
         req_obj = self.get_object()
+        logger.info(
+            f"[RequestViewSet.comments] user={request.user.id}, request_id={req_obj.id}, "
+            f"method={request.method}"
+        )
 
         if request.method in {"GET", "HEAD"}:
             qs = RequestComment.objects.filter(request=req_obj).select_related("author")
             ser = RequestCommentSerializer(
                 qs, many=True, context=self.get_serializer_context()
             )
+            logger.info(f"[RequestViewSet.comments] GET: returning {qs.count()} comments")
             return Response(ser.data)
 
+        logger.info(f"[RequestViewSet.comments] POST: creating comment with data={request.data}")
         ser = RequestCommentSerializer(
             data=request.data, context=self.get_serializer_context()
         )
         ser.is_valid(raise_exception=True)
-        ser.save(request=req_obj, author=request.user)
+        saved = ser.save(request=req_obj, author=request.user)
+        logger.info(f"[RequestViewSet.comments] POST: comment created id={saved.id}")
         return Response(ser.data, status=status.HTTP_201_CREATED)
 
     # ---------- Экшены статусов (только бизнес-валидация) ----------