22 lines
633 B
Python
22 lines
633 B
Python
from rest_framework import permissions
|
|
|
|
|
|
class IsCreator(permissions.BasePermission):
|
|
"""
|
|
Grant permission is request.user same as obj.creator
|
|
"""
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
if obj is not None:
|
|
# allow is authenticated and method is safe
|
|
if request.method in permissions.SAFE_METHODS:
|
|
return True
|
|
|
|
# admins always have permission
|
|
if request.user.is_staff is True:
|
|
return True
|
|
# permission if user is the object's creator
|
|
return obj.creator == request.user
|
|
return False
|
|
|