permissions

management.permissions

Customised permissions.

Classes

CustomDjangoModelPermissions

Bases: DjangoModelPermissions

Modify DjangoModelPermissions to allow only users with view permissions to do GET, OPTIONS and HEAD requests.

Functions

get_queryset(db_field, user)

Return a queryset based on the permissions of the user.

Returns queryset of public objects and objects that the user has change permisions for. For the case of Station objects, having the change permission is necessary to include the object in the queryset - being Public is not enough.

Parameters:

Name	Type	Description	Default
db_field	Field	Field to filter.	required
user	Model	User to check permissions for.	required

Returns:

Type	Description
QuerySet	model.QuerySet: Queryset of objects that the user has permissions for.

Source code in management/permissions.py

def get_queryset(db_field: model.Field, user: model.Model) -> model.QuerySet:
    """Return a queryset based on the permissions of the user.

    Returns queryset of public objects and objects that the user has change permisions
    for. For the case of `Station` objects, having the `change` permission is
    necessary to include the object in the queryset - being `Public` is not enough.

    Args:
        db_field (model.Field): Field to filter.
        user (model.Model): User to check permissions for.

    Returns:
        model.QuerySet: Queryset of objects that the user has permissions for.
    """
    app_name = db_field.related_model._meta.app_label
    model_name = db_field.related_model._meta.model_name
    user_objects = get_objects_for_user(user, f"{app_name}.change_{model_name}")
    public_objects = (
        db_field.related_model.objects.none()
        if model_name == "station"
        else db_field.related_model.objects.filter(visibility="public")
    )
    return user_objects | public_objects