from rest_framework.permissions import BasePermission from rest_framework.permissions import DjangoObjectPermissions class PaperlessObjectPermissions(DjangoObjectPermissions): """ A permissions backend that checks for object-level permissions or for ownership. """ perms_map = { "GET": ["%(app_label)s.view_%(model_name)s"], "OPTIONS": ["%(app_label)s.view_%(model_name)s"], "HEAD": ["%(app_label)s.view_%(model_name)s"], "POST": ["%(app_label)s.add_%(model_name)s"], "PUT": ["%(app_label)s.change_%(model_name)s"], "PATCH": ["%(app_label)s.change_%(model_name)s"], "DELETE": ["%(app_label)s.delete_%(model_name)s"], } def has_object_permission(self, request, view, obj): if hasattr(obj, "owner") and obj.owner is not None: if request.user == obj.owner: return True else: return super().has_object_permission(request, view, obj) else: return True # no owner class PaperlessAdminPermissions(BasePermission): def has_permission(self, request, view): return request.user.has_perm("admin.view_logentry")