Improved permision with additional checking

Author: MySecondLanguage

nxtbn/core/admin_permissions.py

@@ -27,7 +27,7 @@ def has_permission(self, request, view):
             return True
 
         model_cls = None
-        if hasattr(view, 'get_queryset'): # Warning, Never use  hasattr(view, 'queryset') as DRF cache this which may lead to unexpected behavior
+        if hasattr(view, 'get_queryset'): # Warning, Never use  hasattr(view, 'queryset') as DRF cache  this which may lead to unexpected behavior
             model_cls = view.get_queryset().model
         elif hasattr(view, 'model'):
             model_cls = view.model
@@ -58,7 +58,12 @@ def has_permission(self, request, view):
 
 
 
-        model_cls = getattr(view, 'queryset', None) or getattr(view, 'model', None)
+        model_cls = None
+        if hasattr(view, 'get_queryset'): # Warning, Never use  hasattr(view, 'queryset') as DRF cache  this which may lead to unexpected behavior
+            model_cls = view.get_queryset().model
+        elif hasattr(view, 'model'):
+            model_cls = view.model
+            
         if model_cls is None:
             return False
 

nxtbn/order/api/dashboard/views.py

@@ -443,13 +443,15 @@ def check_permissions(self, request):
             )
 
 class OrderPaymentTermUpdateAPIView(generics.UpdateAPIView):
+    model = Order
     permission_classes = (GranularPermission, )
     queryset = Order.objects.all()
     serializer_class = OrderPaymentUpdateSerializer
     lookup_field = 'alias'
     required_perm = PermissionsEnum.CAN_UPDATE_ORDER_PYMENT_TERM
 
 class OrderPaymentMethodUpdateAPIView(generics.UpdateAPIView):
+    model = Order
     permission_classes = (GranularPermission, )
     required_perm = PermissionsEnum.CAN_UPDATE_ORDER_PAYMENT_METHOD
     queryset = Order.objects.all()
@@ -489,43 +491,29 @@ class ReturnRequestFilterMixing:
 
 
 class ReturnRequestAPIView(ReturnRequestFilterMixing, generics.ListCreateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = ReturnRequest
     queryset = ReturnRequest.objects.all()
     serializer_class = ReturnRequestSerializer
-
-    HTTP_PERMISSIONS = {
-        UserRole.STORE_MANAGER: {"POST", 'GET'},
-        UserRole.ADMIN: {"all"},
-        UserRole.ORDER_PROCESSOR: {"POST", 'GET'},
-        UserRole.STORE_VIEWER: {"GET"},
-    }
-    
 
 class ReturnRequestDetailAPIView(generics.RetrieveUpdateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = ReturnRequest
     queryset = ReturnRequest.objects.all()
     serializer_class = ReturnRequestDetailsSerializer
     lookup_field = 'id'
 
-    HTTP_PERMISSIONS = {
-        UserRole.STORE_MANAGER: {"PUT", 'PATCH', 'GET'},
-        UserRole.ADMIN: {"all"},
-        UserRole.ORDER_PROCESSOR: {"PATCH", 'GET'},
-        UserRole.STORE_VIEWER: {"GET"},
-    }
-
     def get_serializer_class(self):
         if self.request.method in ['PATCH', 'PUT']:
             return ReturnRequestStatusUpdateSerializer
         return self.serializer_class
 
 class ReturnLineItemStatusUpdateAPIView(generics.UpdateAPIView):
+    permission_classes = (CommonPermissions, )
+    model = ReturnRequest
+
     serializer_class = ReturnLineItemStatusUpdateSerializer
 
-    HTTP_PERMISSIONS = {
-        UserRole.STORE_MANAGER: {"PUT", 'PATCH', 'GET'},
-        UserRole.ADMIN: {"all"},
-        UserRole.ORDER_PROCESSOR: {"PATCH", 'GET'},
-        UserRole.STORE_VIEWER: {"GET"},
-    }
 
     def update(self, request, *args, **kwargs):
         serializer = self.get_serializer(data=request.data)
@@ -554,14 +542,10 @@ def update(self, request, *args, **kwargs):
 
 
 class ReturnRequestBulkUpdateAPIView(generics.UpdateAPIView):
-    serializer_class = ReturnRequestBulkUpdateSerializer
+    permission_classes = (CommonPermissions, )
+    model = ReturnRequest
 
-    HTTP_PERMISSIONS = {
-        UserRole.STORE_MANAGER: {'all'},
-        UserRole.ADMIN: {"all"},
-        UserRole.ORDER_PROCESSOR: {'all'},
-        UserRole.STORE_VIEWER: {"GET"},
-    }
+    serializer_class = ReturnRequestBulkUpdateSerializer
 
     def update(self, request, *args, **kwargs):
         serializer = self.get_serializer(data=request.data)