add permissions

urmatovnaa · Nov 27, 2022 · e581121 · e581121
1 parent 2599bbe
commit e581121
Show file tree

Hide file tree

Showing 6 changed files with 18 additions and 119 deletions.
diff --git a/question_app/migrations/0001_initial.py b/question_app/migrations/0001_initial.py
diff --git a/question_app/migrations/0002_answer_question_delete_guide_answer_question.py b/question_app/migrations/0002_answer_question_delete_guide_answer_question.py
diff --git a/question_app/migrations/0003_alter_question_profile.py b/question_app/migrations/0003_alter_question_profile.py
diff --git a/question_app/migrations/0004_alter_answer_profile.py b/question_app/migrations/0004_alter_answer_profile.py
diff --git a/question_app/permissions.py b/question_app/permissions.py
@@ -0,0 +1,15 @@
+from rest_framework import permissions
+
+
+class IsAuthorPermission(permissions.BasePermission):
+
+    def has_permission(self, request, view):
+        if request.method == 'GET':
+            return True
+        elif request.user.is_authenticated:
+            return True
+
+    def has_object_permission(self, request, view, obj):
+        if request.user.is_authenticated:
+            return True
+
diff --git a/question_app/views.py b/question_app/views.py
@@ -7,12 +7,13 @@
 
 from question_app.serializers import QuestionSerializer, AnswerSerializer, QuestionDetailSerializer
 from question_app.models import Question, Answer
+from question_app.permissions import IsAuthorPermission
 
 
 class QuestionViewSet(viewsets.ModelViewSet):
     """ Добавление вопроса"""
     serializer_class = QuestionSerializer
-    permission_classes = (IsAuthenticated,)
+    permission_classes = (IsAuthorPermission,)
     serializer_classes = {
         'retrieve': QuestionDetailSerializer,
     }
@@ -27,7 +28,7 @@ def get_queryset(self):
 class AnswerViewSet(viewsets.ModelViewSet):
     """ Вывод вопрос и ответа"""
     serializer_class = AnswerSerializer
-    permission_classes = (IsAuthenticated,)
+    permission_classes = (IsAuthorPermission,)
     lookup_field = 'question_pk'
     queryset = Answer.objects.all()