Coverage for jutil/permissions.py: 0%

# Coverage for jutil/permissions.py : 0%

## 12 statements

Hot-keys on this page

r m x p toggle line displays

j k next/prev highlighted chunk

0 (zero) top of page

1 (one) first highlighted chunk

1 from rest_framework import permissions

2

3

4 class UserIsOwner(permissions.BasePermission):

5 """

6 Object-level permission to only allow authorized users of an object to edit it.

7 Assumes the model instance has an `user` attribute (can be overriden with user_field).

8 """

9

10 user_field = "user"

11

12 def has_object_permission(self, request, view, obj):

13 if not hasattr(obj, self.user_field):

14 raise Exception("UserIsOwner: obj.{} does not exist: {}".format(self.user_field, obj))

15 u = request.user

16 return u and u.is_authenticated and getattr(obj, self.user_field) == u

17

18

19 class IsSameUser(permissions.BasePermission):

20 """

21 Allow access to use only to user himself.

22 """

23

24 def has_object_permission(self, request, view, obj):

25 u = request.user

26 return u and u.is_authenticated and obj.id == u.id