def has_object_permission(self, request, view, obj):
assert isinstance(
obj, (CollectionSubmission, Collection)
), 'obj must be an Collection or CollectionSubmission, got {}'.format(
obj)
auth = get_user_auth(request)
collection = Collection.load(
request.parser_context['kwargs']['node_id'])
pointer_node = collection.collectionsubmission_set.get(
guid___id=request.parser_context['kwargs']
['node_link_id']).guid.referent
if request.method in permissions.SAFE_METHODS:
has_collection_auth = auth.user and auth.user.has_perm(
'read_collection', collection)
if isinstance(pointer_node, AbstractNode):
has_pointer_auth = pointer_node.can_view(auth)
elif isinstance(pointer_node, Collection):
has_pointer_auth = auth.user and auth.user.has_perm(
'read_collection', pointer_node)
public = pointer_node.is_public
has_auth = public or (has_collection_auth and has_pointer_auth)
return has_auth
else:
return auth.user and auth.user.has_perm('write_collection',
collection)
def get_object(self):
cgm = get_object_or_error(
CollectionSubmission,
Q(collection=Collection.load(self.kwargs['collection_id']),
guid___id=self.kwargs['cgm_id']),
self.request,
'submission',
)
# May raise a permission denied
self.check_object_permissions(self.request, cgm)
return cgm
def get_collection_submission(self, check_object_permissions=True):
collection_submission = get_object_or_error(
CollectionSubmission,
Q(collection=Collection.load(self.kwargs['collection_id']),
guid___id=self.kwargs['cgm_id']),
self.request,
'submission',
)
# May raise a permission denied
if check_object_permissions:
self.check_object_permissions(self.request, collection_submission)
return collection_submission
def has_object_permission(self, request, view, obj):
assert isinstance(obj, (CollectedGuidMetadata, Collection)), 'obj must be an Collection or CollectedGuidMetadata, got {}'.format(obj)
auth = get_user_auth(request)
collection = Collection.load(request.parser_context['kwargs']['node_id'])
pointer_node = collection.collectedguidmetadata_set.get(guid___id=request.parser_context['kwargs']['node_link_id']).guid.referent
if request.method in permissions.SAFE_METHODS:
has_collection_auth = auth.user and auth.user.has_perm('read_collection', collection)
if isinstance(pointer_node, AbstractNode):
has_pointer_auth = pointer_node.can_view(auth)
elif isinstance(pointer_node, Collection):
has_pointer_auth = auth.user and auth.user.has_perm('read_collection', pointer_node)
public = pointer_node.is_public
has_auth = public or (has_collection_auth and has_pointer_auth)
return has_auth
else:
return auth.user and auth.user.has_perm('write_collection', collection)