31 lines
997 B
Python
31 lines
997 B
Python
from rest_framework import permissions
|
|
|
|
|
|
class CommerceAccessPermission(permissions.BasePermission):
|
|
"""All employees may read; writes require staff or Django model permission."""
|
|
|
|
action_to_permission = {
|
|
"create": "add",
|
|
"update": "change",
|
|
"partial_update": "change",
|
|
"destroy": "delete",
|
|
}
|
|
|
|
def has_permission(self, request, view):
|
|
user = request.user
|
|
if not user or not user.is_authenticated:
|
|
return False
|
|
if request.method in permissions.SAFE_METHODS:
|
|
return True
|
|
if user.is_staff:
|
|
return True
|
|
|
|
action = getattr(view, "action", None)
|
|
operation = self.action_to_permission.get(action)
|
|
queryset = getattr(view, "queryset", None)
|
|
model = getattr(queryset, "model", None)
|
|
if not operation or model is None:
|
|
return False
|
|
opts = model._meta
|
|
return user.has_perm(f"{opts.app_label}.{operation}_{opts.model_name}")
|