5ccc226498
* dev: remove auto script for registration * dev: make all of the instance admins as owners when adding a instance admin * dev: remove sign out endpoint * dev: update takeoff script to register the instance * dev: reapply instance model * dev: check none for instance configuration encryptions * dev: encrypting secrets configuration * dev: user workflow for registration in instances * dev: add email automation configuration * dev: remove unused imports * dev: reallign migrations * dev: reconfigure license engine registrations * dev: move email check to background worker * dev: add sign up * chore: signup error message * dev: updated onboarding workflows and instance setting * dev: updated template for magic login * chore: page migration changed * dev: updated migrations and authentication for license and update template for workspace invite --------- Co-authored-by: NarayanBavisetti <narayan3119@gmail.com>
115 lines
3.3 KiB
Python
115 lines
3.3 KiB
Python
# Third Party imports
|
|
from rest_framework.permissions import BasePermission, SAFE_METHODS
|
|
|
|
# Module imports
|
|
from plane.db.models import WorkspaceMember
|
|
|
|
|
|
# Permission Mappings
|
|
Owner = 20
|
|
Admin = 15
|
|
Member = 10
|
|
Guest = 5
|
|
|
|
|
|
# TODO: Move the below logic to python match - python v3.10
|
|
class WorkSpaceBasePermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
# allow anyone to create a workspace
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
if request.method == "POST":
|
|
return True
|
|
|
|
## Safe Methods
|
|
if request.method in SAFE_METHODS:
|
|
return True
|
|
|
|
# allow only admins and owners to update the workspace settings
|
|
if request.method in ["PUT", "PATCH"]:
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role__in=[Owner, Admin],
|
|
is_active=True,
|
|
).exists()
|
|
|
|
# allow only owner to delete the workspace
|
|
if request.method == "DELETE":
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role=Owner,
|
|
is_active=True,
|
|
).exists()
|
|
|
|
|
|
class WorkspaceOwnerPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
workspace__slug=view.workspace_slug,
|
|
member=request.user,
|
|
role=Owner,
|
|
).exists()
|
|
|
|
|
|
class WorkSpaceAdminPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role__in=[Owner, Admin],
|
|
is_active=True,
|
|
).exists()
|
|
|
|
|
|
class WorkspaceEntityPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
## Safe Methods -> Handle the filtering logic in queryset
|
|
if request.method in SAFE_METHODS:
|
|
return WorkspaceMember.objects.filter(
|
|
workspace__slug=view.workspace_slug,
|
|
member=request.user,
|
|
is_active=True,
|
|
).exists()
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role__in=[Owner, Admin],
|
|
is_active=True,
|
|
).exists()
|
|
|
|
|
|
class WorkspaceViewerPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
is_active=True,
|
|
).exists()
|
|
|
|
|
|
class WorkspaceUserPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
is_active=True,
|
|
).exists()
|