endpoint permissions updated for professor

apps/certificate/views.py

@@ -57,7 +57,7 @@ class UserCertificatesListView(generics.ListAPIView):
 
 from rest_framework.viewsets import ModelViewSet
 from apps.certificate.serializers import AdminCertificateSerializer
-from apps.account.permissions import IsPanelUser
+from apps.account.permissions import IsPanelUser, IsSuperAdmin
 from django.db.models import Q
 
 
@@ -68,7 +68,7 @@ def is_professor(request):
 class AdminCertificateViewSet(ModelViewSet):
     queryset = Certificate.objects.all()
     serializer_class = AdminCertificateSerializer
-    permission_classes = [permissions.IsAuthenticated, IsPanelUser]
+    permission_classes = [permissions.IsAuthenticated, IsSuperAdmin]
     authentication_classes = [TokenAuthentication]
     pagination_class = StandardResultsSetPagination
 

apps/course/views/admin.py

@@ -294,12 +294,6 @@ class AdminLessonViewSet(viewsets.ModelViewSet):
     def get_queryset(self):
         queryset = Lesson.objects.all().order_by('-id')
 
-        # Professors can only see lessons associated with their own courses
-        if is_professor(self.request):
-            queryset = queryset.filter(
-                course_lessons__course__professor_id=self.request.user.id
-            ).distinct()
-
         search = self.request.query_params.get('search', None)
         if search:
             queryset = queryset.filter(title__icontains=search)
@@ -324,12 +318,6 @@ class AdminGlossaryViewSet(viewsets.ModelViewSet):
     def get_queryset(self):
         queryset = Glossary.objects.all().order_by('-id')
 
-        # Professors can only see glossaries associated with their own courses
-        if is_professor(self.request):
-            queryset = queryset.filter(
-                course_glossaries__course__professor_id=self.request.user.id
-            ).distinct()
-
         search = self.request.query_params.get('search', None)
         if search:
             queryset = queryset.filter(Q(title__icontains=search) | Q(description__icontains=search))
@@ -349,12 +337,6 @@ class AdminAttachmentViewSet(viewsets.ModelViewSet):
     def get_queryset(self):
         queryset = Attachment.objects.all().order_by('-id')
 
-        # Professors can only see attachments associated with their own courses
-        if is_professor(self.request):
-            queryset = queryset.filter(
-                course_attachments__course__professor_id=self.request.user.id
-            ).distinct()
-
         search = self.request.query_params.get('search', None)
         if search:
             queryset = queryset.filter(title__icontains=search)

apps/transaction/views.py

@@ -418,7 +418,7 @@ class TransactionReceiptsListView(generics.ListAPIView):
 
 from rest_framework.viewsets import ModelViewSet
 from apps.transaction.serializers import AdminTransactionSerializer
-from apps.account.permissions import IsPanelUser
+from apps.account.permissions import IsPanelUser, IsSuperAdmin
 from django.db.models import Q
 from utils.pagination import StandardResultsSetPagination
 
@@ -435,7 +435,7 @@ class AdminTransactionViewSet(ModelViewSet):
     """
     queryset = TransactionParticipant.objects.all()
     serializer_class = AdminTransactionSerializer
-    permission_classes = [IsAuthenticated, IsPanelUser]
+    permission_classes = [IsAuthenticated, IsSuperAdmin]
     authentication_classes = [TokenAuthentication]
     pagination_class = StandardResultsSetPagination
     http_method_names = ['get', 'patch', 'head', 'options']