You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
24 lines
853 B
24 lines
853 B
from rest_framework.permissions import BasePermission, SAFE_METHODS
|
|
|
|
|
|
class IsTicketOwnerOrStaff(BasePermission):
|
|
"""
|
|
Grants access to the ticket creator, member of affiliated institution, or staff/admin.
|
|
"""
|
|
def has_permission(self, request, view):
|
|
return bool(request.user and request.user.is_authenticated and request.user.is_active)
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if not request.user or not request.user.is_authenticated:
|
|
return False
|
|
|
|
if request.user.is_staff or getattr(request.user, 'is_super_admin', False) or getattr(request.user, 'is_regional_admin', False):
|
|
return True
|
|
|
|
if obj.user == request.user:
|
|
return True
|
|
|
|
if obj.institution and obj.institution.is_editor(request.user):
|
|
return True
|
|
|
|
return False
|