Implemented permsison class everywhere

Author: MySecondLanguage

nxtbn/core/enum_perms.py

@@ -15,5 +15,8 @@ class PermissionsEnum(models.TextChoices):
     CAN_BULK_PRODUCT_STATUS_UPDATE = "can_bulk_product_status_update"
     CAN_BULK_PRODUCT_DELETE = "can_bulk_product_delete"
 
+    CAN_RECEIVE_TRANSFERRED_STOCK = "can_receive_transferred_stock" 
+    CAN_MARK_STOCK_TRANSFER_AS_COMPLETED = "can_mark_stock_transfer_as_completed"
+
     CAN_READ_CUSTOMER = "can_read_customer"
     CAN_UPDATE_CUSTOMER = "can_create_customer"

nxtbn/filemanager/api/dashboard/views.py

@@ -5,6 +5,7 @@
 from django_filters.rest_framework import DjangoFilterBackend
 
 
+from nxtbn.core.admin_permissions import CommonPermissions
 from nxtbn.filemanager.models import Document, Image
 from nxtbn.filemanager.api.dashboard.serializers import (
     DocumentSerializer,
@@ -21,6 +22,8 @@ class Meta:
         fields = ['id', 'name']
 
 class ImageListView(generics.ListCreateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = Image
     serializer_class = ImageSerializer
     queryset = Image.objects.all().order_by('-created_at')
     pagination_class = NxtbnPagination
@@ -29,19 +32,25 @@ class ImageListView(generics.ListCreateAPIView):
 
 
 class ImageDetailView(generics.RetrieveUpdateDestroyAPIView):
+    permission_classes = (CommonPermissions, )
+    model = Image
     queryset = Image.objects.all()
     serializer_class = ImageSerializer
     pagination_class = NxtbnPagination
     lookup_field = "id"
 
 
 class DocumentListView(generics.ListCreateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = Document
     serializer_class = DocumentSerializer
     queryset = Document.objects.all()
     pagination_class = NxtbnPagination
 
 
 class DocumentDetailView(generics.RetrieveUpdateDestroyAPIView):
+    permission_classes = (CommonPermissions, )
+    model = Document
     queryset = Document.objects.all()
     serializer_class = DocumentSerializer
     pagination_class = NxtbnPagination

nxtbn/purchase/api/dashboard/views.py

@@ -1,4 +1,5 @@
 from rest_framework import generics, viewsets, status
+from nxtbn.core.admin_permissions import CommonPermissions
 from nxtbn.purchase.api.dashboard.serializers import InventoryReceivingSerializer, PurchaseOrderCreateSerializer, PurchaseOrderSerializer, PurchaseOrderDetailSerializer, PurchaseOrderUpdateSerializer
 from nxtbn.purchase.models import PurchaseOrder, PurchaseOrderItem
 from django.db import transaction
@@ -24,6 +25,8 @@
 from rest_framework import status, viewsets
 
 class PurchaseViewSet(viewsets.ModelViewSet):
+    permission_classes = (CommonPermissions, )
+    model = PurchaseOrder
     queryset = PurchaseOrder.objects.all()
     serializer_class = PurchaseOrderSerializer
     pagination_class = NxtbnPagination
@@ -167,6 +170,8 @@ def mark_as_received(self, request, pk=None):
 
 
 class InventoryReceivingAPI(generics.UpdateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = PurchaseOrder
     serializer_class = InventoryReceivingSerializer
     lookup_field = 'pk'
     queryset = PurchaseOrder.objects.all()

nxtbn/shipping/api/dashboard/views.py

@@ -1,5 +1,6 @@
 
 from django.db.models import Q
+from nxtbn.core.admin_permissions import CommonPermissions
 from nxtbn.order import AddressType
 from nxtbn.shipping.api.dashboard.serializers import (
     ShippingMethodSerializer,
@@ -15,6 +16,8 @@
 from nxtbn.users.models import User
 
 class CustomerEligibleShippingMethodstAPI(generics.ListCreateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = ShippingMethod
     serializer_class = ShippingMethodSerializer
 
     def get_queryset(self):
@@ -38,22 +41,30 @@ def get_queryset(self):
         return queryset
 
 class ShippingMethodstListAPI(generics.ListCreateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = ShippingMethod
     serializer_class = ShippingMethodSerializer
     queryset = ShippingMethod.objects.all()
 
 
 class ShippingMethodDetails(generics.RetrieveUpdateDestroyAPIView):
+    permission_classes = (CommonPermissions, )
+    model = ShippingMethod
     serializer_class = ShppingMethodDetailSeralizer
     queryset = ShippingMethod.objects.all()
     lookup_field = 'id'
 
 
 class ShippingRateListCreateView(generics.ListCreateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = ShippingRate
     serializer_class = ShippingRateSerializer
     queryset = ShippingRate.objects.all()
 
 
 class ShippingRateDetailView(generics.RetrieveUpdateDestroyAPIView):
+    permission_classes = (CommonPermissions, )
+    model = ShippingRate
     serializer_class = ShippingRateSerializer
     queryset = ShippingRate.objects.all()
     lookup_field = 'id'
@@ -63,6 +74,8 @@ class ShippingRateDetailView(generics.RetrieveUpdateDestroyAPIView):
 # ==================================================================
 
 class ShippingMethodTranslationViewSet(viewsets.ModelViewSet):
+    permission_classes = (CommonPermissions, )
+    model = ShippingMethodTranslation
     """
     A viewset for viewing and editing ShippingMethod translations.
     """

nxtbn/warehouse/api/dashboard/views.py

@@ -2,6 +2,8 @@
 from django.shortcuts import get_object_or_404
 from rest_framework import viewsets
 from rest_framework import generics, status
+from nxtbn.core.admin_permissions import CommonPermissions, GranularPermission
+from nxtbn.core.enum_perms import PermissionsEnum
 from nxtbn.order.models import Order
 from nxtbn.product.models import ProductVariant
 from nxtbn.warehouse import StockMovementStatus
@@ -26,6 +28,8 @@
 
 
 class WarehouseViewSet(viewsets.ModelViewSet):
+    permission_classes = (CommonPermissions, )
+    model = Warehouse
     queryset = Warehouse.objects.all()
     serializer_class = WarehouseSerializer
     pagination_class = None
@@ -59,6 +63,8 @@ class StockFilterMixin:
 
 
 class StockViewSet(StockFilterMixin, viewsets.ModelViewSet):
+    permission_classes = (CommonPermissions, )
+    model = Stock
     queryset = Stock.objects.select_related('warehouse', 'product_variant').all()
     pagination_class = NxtbnPagination
 
@@ -70,6 +76,8 @@ def get_serializer_class(self):
 
 
 class WarehouseStockByVariantAPIView(APIView):
+    permission_classes = (CommonPermissions, )
+    model = ProductVariant
     def get(self, request, variant_id):
         try:
             # Fetch the product variant
@@ -107,6 +115,8 @@ def get(self, request, variant_id):
 
 
 class UpdateStockWarehouseWise(generics.UpdateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = Stock
     serializer_class = StockUpdateSerializer
 
     def update(self, request, *args, **kwargs):
@@ -172,13 +182,17 @@ def get_queryset(self):
         return StockReservation.objects.all()
 
 class StockReservationListAPIView(StockReservationFilterMixin, generics.ListCreateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = StockReservation
     serializer_class = StockReservationSerializer
     queryset = StockReservation.objects.all()
     pagination_class = NxtbnPagination
 
 
 
 class MergeStockReservationAPIView(generics.UpdateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = StockReservation
     """
     API to transfer stock reservation from one warehouse to another.
     """
@@ -226,6 +240,8 @@ def update(self, request, *args, **kwargs):
 
 
 class RetryReservationAPIView(APIView):
+    permission_classes = (CommonPermissions, )
+    model = StockReservation
     def post(self, request, alias):
         order = get_object_or_404(Order, alias=alias)
         reserve_stock(order)
@@ -234,16 +250,22 @@ def post(self, request, alias):
 
 
 class StockTransferListCreateAPIView(generics.ListCreateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = StockTransfer
     queryset = StockTransfer.objects.prefetch_related('items').all()
     serializer_class = StockTransferSerializer
 
 
 class StockTransferRetrieveUpdateAPIView(generics.RetrieveUpdateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = StockTransfer
     queryset = StockTransfer.objects.all()
     serializer_class = StockTransferSerializer
     lookup_field = 'id'
 
 class StockTransferMarkAsInTransitAPIView(APIView):
+    permission_classes = (CommonPermissions, )
+    model = StockTransfer
     def put(self, request, pk):
         with transaction.atomic():
             transfer = get_object_or_404(StockTransfer, id=pk)
@@ -276,6 +298,9 @@ def put(self, request, pk):
 
 
 class StockTransferReceivingAPI(generics.UpdateAPIView):
+    permission_classes = (GranularPermission, )
+    model = StockTransfer
+    required_perm = PermissionsEnum.CAN_RECEIVE_TRANSFERRED_STOCK
     serializer_class = StockTransferReceivingSerializer
     lookup_field = 'pk'
     queryset = StockTransfer.objects.all()
@@ -315,6 +340,9 @@ def update(self, request, *args, **kwargs):
 
 
 class StockTransferMarkedAsCompletedAPIView(APIView):
+    permission_classes = (GranularPermission, )
+    model = StockTransfer
+    required_perm = PermissionsEnum.CAN_MARK_STOCK_TRANSFER_AS_COMPLETED
     def put(self, request, pk):
         transfer = get_object_or_404(StockTransfer, id=pk)
 

nxtbn/warehouse/models.py

@@ -2,6 +2,7 @@
 from django.forms import ValidationError
 from django.db.models import Sum
 
+from nxtbn.core.enum_perms import PermissionsEnum
 from nxtbn.core.models import AbstractBaseModel
 from nxtbn.order.models import Order, OrderLineItem
 from nxtbn.product.models import ProductVariant
@@ -89,6 +90,12 @@ class StockTransfer(AbstractBaseModel):
 
     status = models.CharField(max_length=20, choices=StockMovementStatus.choices, default=StockMovementStatus.PENDING)
     created_by = models.ForeignKey(User, on_delete=models.SET_NULL, null=True)
+
+    class Meta:
+        permissions = [
+            (PermissionsEnum.CAN_RECEIVE_TRANSFERRED_STOCK, "Can receive transferred stock"),
+            (PermissionsEnum.CAN_MARK_STOCK_TRANSFER_AS_COMPLETED, "Can mark stock transfer as completed"),
+        ]
 
     def __str__(self):
         return f"Transfer {self.id} - {self.from_warehouse} to {self.to_warehouse}"