109 lines
3.3 KiB
Python
109 lines
3.3 KiB
Python
from rest_framework import permissions
|
|
|
|
from apps.workspaces.models import Workspace, WorkspaceMembership
|
|
|
|
|
|
class IsWorkspaceOwner(permissions.BasePermission):
|
|
"""
|
|
Permission check:
|
|
- User must be the explicit 'owner' on the Workspace model.
|
|
- OR User must have a WorkspaceMembership with the 'OWNER' role.
|
|
"""
|
|
message = "Access denied. You must be the Workspace Owner to perform this action."
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if not request.user or not request.user.is_authenticated:
|
|
return False
|
|
|
|
if isinstance(obj, Workspace):
|
|
workspace = obj
|
|
elif isinstance(obj, WorkspaceMembership):
|
|
workspace = obj.workspace
|
|
elif hasattr(obj, 'workspace'):
|
|
workspace = obj.workspace
|
|
else:
|
|
return False
|
|
|
|
if workspace.owner == request.user:
|
|
return True
|
|
|
|
return WorkspaceMembership.objects.filter(
|
|
workspace=workspace,
|
|
user=request.user,
|
|
role=WorkspaceMembership.Role.OWNER,
|
|
is_active=True
|
|
).exists()
|
|
|
|
|
|
class IsWorkspaceAdmin(permissions.BasePermission):
|
|
"""
|
|
Permission check:
|
|
- User's role in the workspace is either 'ADMIN' or 'OWNER'.
|
|
"""
|
|
message = "Access denied. You must be a Workspace Admin or Owner to perform this action."
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if not request.user or not request.user.is_authenticated:
|
|
return False
|
|
|
|
if isinstance(obj, Workspace):
|
|
workspace = obj
|
|
elif isinstance(obj, WorkspaceMembership):
|
|
workspace = obj.workspace
|
|
elif hasattr(obj, 'workspace'):
|
|
workspace = obj.workspace
|
|
else:
|
|
return False
|
|
|
|
if workspace.owner == request.user:
|
|
return True
|
|
|
|
allowed_roles = [
|
|
WorkspaceMembership.Role.OWNER,
|
|
WorkspaceMembership.Role.ADMIN,
|
|
]
|
|
|
|
return WorkspaceMembership.objects.filter(
|
|
workspace=workspace,
|
|
user=request.user,
|
|
role__in=allowed_roles,
|
|
is_active=True
|
|
).exists()
|
|
|
|
|
|
class IsWorkspaceMember(permissions.BasePermission):
|
|
"""
|
|
Permission check:
|
|
- User's role in the workspace is 'OWNER', 'ADMIN', or 'MEMBER'.
|
|
"""
|
|
message = "Access denied. You must be an active member of this workspace."
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if not request.user or not request.user.is_authenticated:
|
|
return False
|
|
|
|
if isinstance(obj, Workspace):
|
|
workspace = obj
|
|
elif isinstance(obj, WorkspaceMembership):
|
|
workspace = obj.workspace
|
|
elif hasattr(obj, 'workspace'):
|
|
workspace = obj.workspace
|
|
else:
|
|
return False
|
|
|
|
if workspace.owner == request.user:
|
|
return True
|
|
|
|
allowed_roles = [
|
|
WorkspaceMembership.Role.OWNER,
|
|
WorkspaceMembership.Role.ADMIN,
|
|
WorkspaceMembership.Role.MEMBER,
|
|
]
|
|
|
|
return WorkspaceMembership.objects.filter(
|
|
workspace=workspace,
|
|
user=request.user,
|
|
role__in=allowed_roles,
|
|
is_active=True
|
|
).exists()
|