29 lines
1,005 B
Python
29 lines
1,005 B
Python
from rest_framework.permissions import BasePermission
|
|
|
|
from .services import AuthorizationService
|
|
|
|
|
|
class HybridPermission(BasePermission):
|
|
"""DRF permission class that uses AuthorizationService."""
|
|
|
|
def has_permission(self, request, view):
|
|
if not request.user or not request.user.is_authenticated:
|
|
return False
|
|
required = getattr(view, "required_permissions", [])
|
|
if not required:
|
|
return True
|
|
authz = AuthorizationService()
|
|
return authz.has_any_permission(request.user, required)
|
|
|
|
|
|
def require_permission(*codenames: str):
|
|
"""Decorator/class for DRF views requiring all listed permissions."""
|
|
|
|
class PermissionRequired(HybridPermission):
|
|
def has_permission(self, request, view):
|
|
if not super().has_permission(request, view):
|
|
return False
|
|
authz = AuthorizationService()
|
|
return authz.has_all_permissions(request.user, list(codenames))
|
|
|
|
return PermissionRequired
|