diff --git a/README.md b/README.md index 433aa0a31cd8f3c70ceea087e549be4b34314c28..6dc314ee1a31f5e9cbc2640c8a26bdc9b20f56d5 100644 --- a/README.md +++ b/README.md @@ -176,17 +176,21 @@ With inherit, Users can herit from Anons. Also Owners can herit from Users. Eg. with this model Anons can view, Auths can add & Owners can edit & delete. +Note that `owner_perms` need a `owner_field` meta that point the field with owner user. + ```python from djangoldp.models import Model class Todo(Model): name = models.CharField(max_length=255) deadline = models.DateTimeField() - + user = models.ForeignKey(settings.AUTH_USER_MODEL) + class Meta: anonymous_perms = ['view'] authenticated_perms = ['inherit', 'add'] owner_perms = ['inherit', 'change', 'control', 'delete'] + owner_field = 'user' ``` diff --git a/djangoldp/__init__.py b/djangoldp/__init__.py index e34d4cff350ca58512df3cc619e1cc6921252569..8169cccc71c380b248ddf6b13d84993ff3e05a5d 100644 --- a/djangoldp/__init__.py +++ b/djangoldp/__init__.py @@ -1,4 +1,4 @@ from django.db.models import options __version__ = '0.0.0' -options.DEFAULT_NAMES += ('lookup_field', 'rdf_type', 'rdf_context', 'auto_author', 'view_set', 'container_path', 'permission_classes', 'serializer_fields', 'nested_fields', 'depth', 'anonymous_perms', 'authenticated_perms', 'owner_perms') +options.DEFAULT_NAMES += ('lookup_field', 'rdf_type', 'rdf_context', 'auto_author', 'owner_field', 'view_set', 'container_path', 'permission_classes', 'serializer_fields', 'nested_fields', 'depth', 'anonymous_perms', 'authenticated_perms', 'owner_perms') diff --git a/djangoldp/permissions.py b/djangoldp/permissions.py index 07235436876680911f2f7cbdc28f41a7ae0177ab..24bdc866b51a30b5eecdcc89504d5622b367b321 100644 --- a/djangoldp/permissions.py +++ b/djangoldp/permissions.py @@ -13,21 +13,21 @@ class LDPPermissions(BasePermission): authenticated_perms = ['inherit'] owner_perms = ['inherit'] - def user_permissions(self, user, obj): + def user_permissions(self, user, model, obj=None): """ - Filter user permissions for a given object + Filter user permissions for a model class """ # Get Anonymous permissions from Model's Meta. If not found use default - anonymous_perms = getattr(obj._meta, 'anonymous_perms', self.anonymous_perms) + anonymous_perms = getattr(model._meta, 'anonymous_perms', self.anonymous_perms) # Get Auth permissions from Model's Meta. If not found use default - authenticated_perms = getattr(obj._meta, 'authenticated_perms', self.authenticated_perms) + authenticated_perms = getattr(model._meta, 'authenticated_perms', self.authenticated_perms) # Extend Auth if inherit is given if 'inherit' in authenticated_perms: authenticated_perms = authenticated_perms + list(set(anonymous_perms) - set(authenticated_perms)) # Get Owner permissions from Model's Meta. If not found use default - owner_perms = getattr(obj._meta, 'owner_perms', self.owner_perms) + owner_perms = getattr(model._meta, 'owner_perms', self.owner_perms) # Extend Owner if inherit is given if 'inherit' in owner_perms: owner_perms = owner_perms + list(set(authenticated_perms) - set(owner_perms)) @@ -36,7 +36,7 @@ class LDPPermissions(BasePermission): return anonymous_perms else: - if hasattr(obj._meta, 'auto_author') and getattr(obj, getattr(obj._meta, 'auto_author')) == user: + if obj and hasattr(model._meta, 'owner_field') and getattr(obj, getattr(model._meta, 'owner_field')) == user: return owner_perms else: @@ -76,10 +76,15 @@ class LDPPermissions(BasePermission): """ Access to containers """ - perms = self.get_permissions(request.method, view.model) - # A bit tricky, but feels redondant to redeclarate perms_map + model = view.model + perms = self.get_permissions(request.method, model) + try: + obj = view.model.resolve_id(request._request.path) + except: + obj = None + for perm in perms: - if not perm.split('.')[1].split('_')[0] in self.user_permissions(request.user, view.model): + if not perm.split('.')[1].split('_')[0] in self.user_permissions(request.user, model, obj): return False return True @@ -91,10 +96,10 @@ class LDPPermissions(BasePermission): User does not have permission: 403 """ perms = self.get_permissions(request.method, obj) + model = obj - # A bit tricky, but feels redondant to redeclarate perms_map for perm in perms: - if not perm.split('.')[1].split('_')[0] in self.user_permissions(request.user, obj): + if not perm.split('.')[1].split('_')[0] in self.user_permissions(request.user, model, obj): return False return True