627056f1ae
Remove the APIRoot view. Remove the Endpoint class. Remove the EndpointSerializer. Move API documentation generation from the root urls module to the app's urls module. Update the app API URL generation to be based on viewsets instead of an custom api_urls list. Remove MayanObjectPermissionsFilter and replace it with MayanViewSetObjectPermissionsFilter which allows mapping a required permission to a specific viewset action. Signed-off-by: Roberto Rosario <Roberto.Rosario@mayan-edms.com>
36 lines
1.2 KiB
Python
36 lines
1.2 KiB
Python
from __future__ import absolute_import, unicode_literals
|
|
|
|
from django.core.exceptions import PermissionDenied
|
|
|
|
from rest_framework.permissions import BasePermission
|
|
|
|
from mayan.apps.permissions import Permission
|
|
|
|
|
|
class MayanViewSetPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
"""
|
|
Block the API view by access using a permission.
|
|
Required the view_permission_map class attribute which is a dictionary
|
|
that matches a view actions ('create', 'destroy', etc) to a single
|
|
permission instance.
|
|
Example: view_permission_map = {
|
|
'update': permission_..._edit
|
|
'list': permission_..._view
|
|
}
|
|
"""
|
|
view_permission_dictionary = getattr(view, 'view_permission_map', {})
|
|
view_permission = view_permission_dictionary.get(view.action, None)
|
|
|
|
if view_permission:
|
|
try:
|
|
Permission.check_user_permission(
|
|
permission=view_permission, user=request.user
|
|
)
|
|
except PermissionDenied:
|
|
return False
|
|
else:
|
|
return True
|
|
else:
|
|
return True
|