how to solve permission classes or logics that are not working

user_15785966 0
Viewed 74

I have a permission_classes in modelviewset like this :

class MeetingViewSet(viewsets.ModelViewSet):
   
queryset = Meeting.objects.all()

serializer_class = MeetingSerializer
permission_classes =[IsOwner|IsCreator|IsInvited]

and this is the related model :

class Meeting(models.Model):

    TIMEZONES = tuple(zip(pytz.all_timezones, pytz.all_timezones))

    title = models.CharField(max_length=255)
    description = models.TextField()

    # Date Time Is in UTC
    date_time = models.DateTimeField()
    time_zone = models.CharField(max_length=32, choices=TIMEZONES, 
    default='UTC')

    #TODO: Convert to REMOTE_USER, Temperory integer
    host = models.ForeignKey(get_user_model(),on_delete=models.CASCADE)

    is_private = models.BooleanField(default=True)
    is_virtual = models.BooleanField(default=True)

    url = models.CharField(blank=True,max_length=100)

    deleted = models.BooleanField(default=False)
    time_created = models.DateTimeField(auto_now_add=True)

    def __str__(self):
        return '%s' % (self.title)
        # TODO: Return host.username after bringup REMOTE_USER

    def is_invited(self, email):
        meeting = MeetingMember.objects.filter(meeting=self, email=email)
        if meeting.exists():
            return True
        return False

IsOwner is for the owner to update/delete/get/post and Iscreateor is for method post to create new object and IsInvited for method Get and invited users exististing in model :

class IsOwner(BasePermission):
  

    def has_object_permission(self, request, view, object):
       
        return  request.user.pk == object.host and request.user.is_authenticated
  
class IsCreator(BasePermission):
    
    def has_permission(self, request ,view):
     
        return request.method == 'POST' and request.user.is_authenticated

class IsInvited(BasePermission):
   
    message = 'you must have been invited to see this meeting'
    
    def has_object_permission(self,request, view,object):
       
        return request.method == 'GET' and object.is_invited(request.user.email) and request.user.is_authenticated

and user must be authenticated in all three classes but when i use simple jwt and authenticate with a different user i can still get objects created by another user which should be forbidden bcs only the owner can access the object what am i missing?

django-rest-framework
1 Answers

After studing This Turorial, i realized that i needed to check the authentication only in has_permission so i changed the code like this and it works :

class IsOwner(BasePermission):
    def has_permission(self, request, view):
        if request.user.is_authenticated:
            return True
        return False

    def has_object_permission(self, request, view, object):
        if request.user == object.host:
            return True
        return False


class IsInvited(BasePermission):

    def has_permission(self, request, view):
        if request.user.is_authenticated:
            return True
        return False
   
    
    def has_object_permission(self,request, view,object):
        if  object.is_invited(request.user.email):
            return True
        return False
user_157859660
Related