61ebda6e63
- Add back support for API views but using the api_urlpatterns list. Needed for the current user API until a dynamic route router is implemented that can allow a viewset action to specify its entire URL. - Make sure the user is authenticated before trying to the user permissions. - Improve how external_object_list options are read from the class. - None authenticated users will get a blank queryset if the view doesn't require a permission. Signed-off-by: Roberto Rosario <Roberto.Rosario@mayan-edms.com>
39 lines
1.3 KiB
Python
39 lines
1.3 KiB
Python
from __future__ import absolute_import, unicode_literals
|
|
|
|
from django.core.exceptions import PermissionDenied
|
|
|
|
from rest_framework.permissions import BasePermission, IsAuthenticated
|
|
|
|
from mayan.apps.permissions import Permission
|
|
|
|
|
|
class MayanViewSetPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
"""
|
|
Block the API view by access using a permission.
|
|
Required the view_permission_map class attribute which is a dictionary
|
|
that matches a view actions ('create', 'destroy', etc) to a single
|
|
permission instance.
|
|
Example: view_permission_map = {
|
|
'update': permission_..._edit
|
|
'list': permission_..._view
|
|
}
|
|
"""
|
|
if not request.user or not request.user.is_authenticated:
|
|
return False
|
|
|
|
view_permission_dictionary = getattr(view, 'view_permission_map', {})
|
|
view_permission = view_permission_dictionary.get(view.action, None)
|
|
|
|
if view_permission:
|
|
try:
|
|
Permission.check_user_permission(
|
|
permission=view_permission, user=request.user
|
|
)
|
|
except PermissionDenied:
|
|
return False
|
|
else:
|
|
return True
|
|
else:
|
|
return True
|