You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
58 lines
1.9 KiB
58 lines
1.9 KiB
from rest_framework import permissions
|
|
from apps.profiles.models import InstitutionMember
|
|
|
|
|
|
class IsOrganizerAdminOrReadOnly(permissions.BasePermission):
|
|
"""
|
|
Allows read-only access for any request.
|
|
Restricts write/delete access to institution admins, editors, or system superusers.
|
|
"""
|
|
def has_permission(self, request, view):
|
|
if request.method in permissions.SAFE_METHODS:
|
|
return True
|
|
return request.user and request.user.is_authenticated
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if request.method in permissions.SAFE_METHODS:
|
|
return True
|
|
|
|
user = request.user
|
|
if not user or not user.is_authenticated:
|
|
return False
|
|
|
|
if user.is_superuser or getattr(user, 'user_type', None) in ['super_admin', 'regional_admin']:
|
|
return True
|
|
|
|
organizer = getattr(obj, 'organizer', None)
|
|
if not organizer:
|
|
return False
|
|
|
|
# Check if user is an admin or editor of this institution
|
|
return InstitutionMember.objects.filter(
|
|
institution=organizer,
|
|
user=user,
|
|
role__in=['admin', 'editor']
|
|
).exists()
|
|
|
|
|
|
class IsOrganizerOrStaff(permissions.BasePermission):
|
|
"""
|
|
Permission for viewing attendees / participants list.
|
|
"""
|
|
def has_permission(self, request, view):
|
|
return request.user and request.user.is_authenticated
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
user = request.user
|
|
if user.is_superuser or getattr(user, 'user_type', None) in ['super_admin', 'regional_admin']:
|
|
return True
|
|
|
|
organizer = getattr(obj, 'organizer', None)
|
|
if not organizer:
|
|
return False
|
|
|
|
return InstitutionMember.objects.filter(
|
|
institution=organizer,
|
|
user=user,
|
|
role__in=['admin', 'editor']
|
|
).exists()
|