126 lines
4.5 KiB
Python
126 lines
4.5 KiB
Python
# backend/api/v1/schedule/permissions.py
|
|
"""
|
|
Права доступа для django-scheduler API.
|
|
"""
|
|
|
|
from rest_framework import permissions
|
|
|
|
from scheduling.services import (
|
|
user_can_create_event,
|
|
user_can_edit_calendar,
|
|
user_can_edit_event,
|
|
user_can_manage_calendar_notifications,
|
|
user_can_view_calendar,
|
|
user_can_view_event,
|
|
)
|
|
|
|
|
|
class IsOwnerOfCalendar(permissions.BasePermission):
|
|
"""
|
|
Только owner календаря может изменять/удалять календарь.
|
|
Viewer и editor могут только читать календарь.
|
|
"""
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
"""Проверка прав на календарь."""
|
|
# SAFE_METHODS (GET, HEAD, OPTIONS) доступны всем участникам
|
|
if request.method in permissions.SAFE_METHODS:
|
|
return user_can_view_calendar(request.user, obj)
|
|
|
|
if getattr(view, "action", None) == "notification_settings":
|
|
return user_can_manage_calendar_notifications(request.user, obj)
|
|
|
|
# Только owner может изменять/удалять календарь
|
|
return user_can_edit_calendar(request.user, obj)
|
|
|
|
|
|
class CanEditCalendar(permissions.BasePermission):
|
|
"""
|
|
Права для событий в календаре:
|
|
- owner: полный доступ (create, read, update, delete)
|
|
- editor: может создавать, изменять и удалять события
|
|
(create, read, update, delete)
|
|
- viewer: только чтение (read)
|
|
"""
|
|
|
|
def has_permission(self, request, view):
|
|
"""Проверка прав на создание события."""
|
|
# Для создания события нужно быть owner или editor календаря
|
|
if view.action == "create":
|
|
calendar_id = request.data.get("calendar")
|
|
if not calendar_id:
|
|
return False
|
|
|
|
from schedule.models import Calendar
|
|
|
|
try:
|
|
calendar = Calendar.objects.get(id=calendar_id)
|
|
except Calendar.DoesNotExist:
|
|
return False
|
|
|
|
return user_can_create_event(request.user, calendar)
|
|
|
|
return True
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
"""Проверка прав на событие."""
|
|
# Event object
|
|
event = obj
|
|
|
|
# SAFE_METHODS (GET, HEAD, OPTIONS) доступны всем участникам
|
|
if request.method in permissions.SAFE_METHODS:
|
|
return user_can_view_event(request.user, event)
|
|
|
|
# Для изменения/удаления нужны права editor или owner
|
|
return user_can_edit_event(request.user, event)
|
|
|
|
|
|
class CanManageEventRelation(permissions.BasePermission):
|
|
"""Участников события видят приглашённые, изменяют только редакторы."""
|
|
|
|
def has_permission(self, request, view):
|
|
if not (request.user and request.user.is_authenticated):
|
|
return False
|
|
if getattr(view, "action", None) != "create":
|
|
return True
|
|
|
|
from schedule.models import Event
|
|
|
|
try:
|
|
event = Event.objects.select_related("calendar").get(
|
|
pk=request.data.get("event")
|
|
)
|
|
except (Event.DoesNotExist, TypeError, ValueError):
|
|
return False
|
|
return user_can_edit_event(request.user, event)
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if request.method in permissions.SAFE_METHODS:
|
|
return user_can_view_event(request.user, obj.event)
|
|
return user_can_edit_event(request.user, obj.event)
|
|
|
|
|
|
class CanManageScheduleRule(permissions.BasePermission):
|
|
"""Правила повторений меняют только редакторы всех связанных событий."""
|
|
|
|
def has_permission(self, request, view):
|
|
return bool(request.user and request.user.is_authenticated)
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if request.method in permissions.SAFE_METHODS:
|
|
return True
|
|
user = request.user
|
|
if user.is_staff or user.is_superuser:
|
|
return True
|
|
|
|
from schedule.models import Event
|
|
|
|
events = list(
|
|
Event.objects.filter(rule=obj).select_related(
|
|
"calendar", "calendar__binding"
|
|
)
|
|
)
|
|
return bool(events) and all(
|
|
user_can_edit_event(user, event) for event in events
|
|
)
|