42 lines
1.2 KiB
Python
42 lines
1.2 KiB
Python
from rest_framework.permissions import IsAuthenticated, SAFE_METHODS
|
|
|
|
|
|
class IsPostAuthorOnly(IsAuthenticated):
|
|
"""
|
|
View-level: must be authenticated (inherited).
|
|
Object-level unsafe: post author only.
|
|
Used for update / partial_update.
|
|
"""
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if request.method in SAFE_METHODS:
|
|
return True
|
|
|
|
return obj.author == request.user
|
|
|
|
|
|
class CanDeletePost(IsAuthenticated):
|
|
"""
|
|
View-level: must be authenticated (inherited).
|
|
Object-level DELETE:
|
|
- Post author
|
|
- Superuser (anywhere)
|
|
- Hub owner (if post belongs to a hub)
|
|
- Hub moderator with managing_posts=True (if post belongs to a hub)
|
|
"""
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if request.method in SAFE_METHODS:
|
|
return True
|
|
user = request.user
|
|
if obj.author == user or user.is_superuser:
|
|
return True
|
|
|
|
hub = obj.hub
|
|
if hub:
|
|
if hub.owner == user:
|
|
return True
|
|
|
|
return hub.moderators.filter(user=user, managing_posts=True).exists()
|
|
return False
|