github.com/amrnt/deis@v1.3.1/controller/api/permissions.py (about)

     1  from rest_framework import permissions
     2  from django.conf import settings
     3  from django.contrib.auth.models import AnonymousUser
     4  
     5  from api import models
     6  
     7  
     8  def is_app_user(request, obj):
     9      if request.user.is_superuser or \
    10              isinstance(obj, models.App) and obj.owner == request.user or \
    11              hasattr(obj, 'app') and obj.app.owner == request.user:
    12          return True
    13      elif request.user.has_perm('use_app', obj) or \
    14              hasattr(obj, 'app') and request.user.has_perm('use_app', obj.app):
    15          return request.method != 'DELETE'
    16      else:
    17          return False
    18  
    19  
    20  class IsAnonymous(permissions.BasePermission):
    21      """
    22      View permission to allow anonymous users.
    23      """
    24  
    25      def has_permission(self, request, view):
    26          """
    27          Return `True` if permission is granted, `False` otherwise.
    28          """
    29          return type(request.user) is AnonymousUser
    30  
    31  
    32  class IsOwner(permissions.BasePermission):
    33      """
    34      Object-level permission to allow only owners of an object to access it.
    35      Assumes the model instance has an `owner` attribute.
    36      """
    37  
    38      def has_object_permission(self, request, view, obj):
    39          if hasattr(obj, 'owner'):
    40              return obj.owner == request.user
    41          else:
    42              return False
    43  
    44  
    45  class IsOwnerOrAdmin(permissions.BasePermission):
    46      """
    47      Object-level permission to allow only owners of an object or administrators to access it.
    48      Assumes the model instance has an `owner` attribute.
    49      """
    50      def has_object_permission(self, request, view, obj):
    51          if request.user.is_superuser:
    52              return True
    53          if hasattr(obj, 'owner'):
    54              return obj.owner == request.user
    55          else:
    56              return False
    57  
    58  
    59  class IsAppUser(permissions.BasePermission):
    60      """
    61      Object-level permission to allow owners or collaborators to access
    62      an app-related model.
    63      """
    64      def has_object_permission(self, request, view, obj):
    65          return is_app_user(request, obj)
    66  
    67  
    68  class IsAdmin(permissions.BasePermission):
    69      """
    70      View permission to allow only admins.
    71      """
    72  
    73      def has_permission(self, request, view):
    74          """
    75          Return `True` if permission is granted, `False` otherwise.
    76          """
    77          return request.user.is_superuser
    78  
    79  
    80  class IsAdminOrSafeMethod(permissions.BasePermission):
    81      """
    82      View permission to allow only admins to use unsafe methods
    83      including POST, PUT, DELETE.
    84  
    85      This allows
    86      """
    87  
    88      def has_permission(self, request, view):
    89          """
    90          Return `True` if permission is granted, `False` otherwise.
    91          """
    92          return request.method in permissions.SAFE_METHODS or request.user.is_superuser
    93  
    94  
    95  class HasRegistrationAuth(permissions.BasePermission):
    96      """
    97      Checks to see if registration is enabled
    98      """
    99      def has_permission(self, request, view):
   100          return settings.REGISTRATION_ENABLED
   101  
   102  
   103  class HasBuilderAuth(permissions.BasePermission):
   104      """
   105      View permission to allow builder to perform actions
   106      with a special HTTP header
   107      """
   108  
   109      def has_permission(self, request, view):
   110          """
   111          Return `True` if permission is granted, `False` otherwise.
   112          """
   113          auth_header = request.environ.get('HTTP_X_DEIS_BUILDER_AUTH')
   114          if not auth_header:
   115              return False
   116          return auth_header == settings.BUILDER_KEY