added custom permission IsCreator

back_latienda/permissions.py

@@ -0,0 +1,21 @@
+from rest_framework import permissions
+
+
+class IsCreator(permissions.BasePermission):
+    """
+    Grant permission is request.user same as obj.creator
+    """
+
+    def has_object_permission(self, request, view, obj):
+        if obj is not None:
+            # allow is authenticated and method is safe
+            if request.method in permissions.SAFE_METHODS:
+                return True
+
+            # admins always have permission
+            if request.user.is_staff is True:
+                return True
+            # permission if user is the object's creator
+            return obj.creator == request.user
+        return False
+