You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
78 lines
3.1 KiB
78 lines
3.1 KiB
from rest_framework.permissions import BasePermission, SAFE_METHODS
|
|
from apps.profiles.models.institution import Institution, InstitutionMember
|
|
|
|
|
|
class IsInstitutionAdminOrReadOnly(BasePermission):
|
|
"""
|
|
Read access is open to all.
|
|
Write/modify access is restricted to Platform Admins (super_admin, regional_admin)
|
|
or delegated Institution Administrators.
|
|
"""
|
|
def has_permission(self, request, view):
|
|
if request.method in SAFE_METHODS:
|
|
return True
|
|
return bool(request.user and request.user.is_authenticated and request.user.is_active)
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if request.method in SAFE_METHODS:
|
|
return True
|
|
if not request.user or not request.user.is_authenticated or not request.user.is_active:
|
|
return False
|
|
|
|
# Super admin and regional admin have global write authority
|
|
if getattr(request.user, 'is_super_admin', False) or getattr(request.user, 'is_regional_admin', False):
|
|
return True
|
|
|
|
# Check if obj is Institution or a related model with an institution foreign key
|
|
institution = obj if isinstance(obj, Institution) else getattr(obj, 'institution', None)
|
|
if not institution:
|
|
return False
|
|
|
|
return institution.is_admin(request.user)
|
|
|
|
|
|
class IsInstitutionEditorOrReadOnly(BasePermission):
|
|
"""
|
|
Read access is open to all.
|
|
Write/modify access is permitted for Platform Admins, Institution Admins, and Institution Editors.
|
|
"""
|
|
def has_permission(self, request, view):
|
|
if request.method in SAFE_METHODS:
|
|
return True
|
|
return bool(request.user and request.user.is_authenticated and request.user.is_active)
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if request.method in SAFE_METHODS:
|
|
return True
|
|
if not request.user or not request.user.is_authenticated or not request.user.is_active:
|
|
return False
|
|
|
|
if getattr(request.user, 'is_super_admin', False) or getattr(request.user, 'is_regional_admin', False):
|
|
return True
|
|
|
|
institution = obj if isinstance(obj, Institution) else getattr(obj, 'institution', None)
|
|
if not institution:
|
|
return False
|
|
|
|
return institution.is_editor(request.user)
|
|
|
|
|
|
class CanManageInstitutionMembers(BasePermission):
|
|
"""
|
|
Permits only Platform Admins and Institution Admins to manage and delegate member roles.
|
|
"""
|
|
def has_permission(self, request, view):
|
|
return bool(request.user and request.user.is_authenticated and request.user.is_active)
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if not request.user or not request.user.is_authenticated or not request.user.is_active:
|
|
return False
|
|
|
|
if getattr(request.user, 'is_super_admin', False) or getattr(request.user, 'is_regional_admin', False):
|
|
return True
|
|
|
|
institution = obj if isinstance(obj, Institution) else getattr(obj, 'institution', None)
|
|
if not institution:
|
|
return False
|
|
|
|
return institution.is_admin(request.user)
|