73 lines
2.4 KiB
Python
73 lines
2.4 KiB
Python
from rest_framework.permissions import SAFE_METHODS, BasePermission
|
|
|
|
from guests.constants import EDITABLE_BY_AUTHOR_STATUSES, GuestVisitStatus
|
|
from guests.permissions import (
|
|
can_decide_guest_visit,
|
|
can_manage_guest_account,
|
|
is_guest_admin,
|
|
)
|
|
|
|
|
|
class GuestVisitPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
return bool(request.user and request.user.is_authenticated)
|
|
|
|
@staticmethod
|
|
def _regular_user_permission(request, action, obj) -> bool:
|
|
user = request.user
|
|
is_owner = obj.inviter_id == user.id
|
|
owner_actions = {
|
|
"submit",
|
|
"provide_info",
|
|
"cancel",
|
|
"return_to_work",
|
|
"destroy",
|
|
"comments",
|
|
"delete_comment",
|
|
}
|
|
denied_actions = {
|
|
"approve",
|
|
"reject",
|
|
"request_info",
|
|
"revoke",
|
|
"sync_ldap",
|
|
}
|
|
if request.method in SAFE_METHODS or action in owner_actions:
|
|
return is_owner
|
|
if action in denied_actions:
|
|
return False
|
|
if action in {"update", "partial_update"}:
|
|
return is_owner and obj.status in EDITABLE_BY_AUTHOR_STATUSES
|
|
if action in {"attach_document", "remove_document"}:
|
|
editable_statuses = {
|
|
*EDITABLE_BY_AUTHOR_STATUSES,
|
|
GuestVisitStatus.PENDING,
|
|
}
|
|
return is_owner and obj.status in editable_statuses
|
|
return False
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
action = getattr(view, "action", "")
|
|
if is_guest_admin(request.user):
|
|
return True
|
|
return self._regular_user_permission(request, action, obj)
|
|
|
|
|
|
class GuestAdminPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if not request.user or not request.user.is_authenticated:
|
|
return False
|
|
if request.method in SAFE_METHODS:
|
|
return True
|
|
action = getattr(view, "action", "")
|
|
if action in {"comments", "delete_comment", "documents"}:
|
|
return True
|
|
if action in {"sync_ldap", "blacklist", "unblacklist"}:
|
|
return can_manage_guest_account(request.user)
|
|
return is_guest_admin(request.user)
|
|
|
|
|
|
class GuestDecisionPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
return can_decide_guest_visit(request.user)
|