Fix roles

apps/utils/permissions.py

@@ -31,6 +31,7 @@ class IsRefreshTokenValid(permissions.BasePermission):
     """
     Check if user has a valid refresh token and authenticated
     """
+
     def has_permission(self, request, view):
         """Check permissions by refresh token and default REST permission IsAuthenticated"""
         refresh_token = request.COOKIES.get('refresh_token')
@@ -55,6 +56,7 @@ class IsGuest(permissions.IsAuthenticatedOrReadOnly):
     """
     Object-level permission to only allow owners of an object to edit it.
     """
+
     def has_permission(self, request, view):
         rules = [
             request.user.is_superuser,
@@ -63,7 +65,6 @@ class IsGuest(permissions.IsAuthenticatedOrReadOnly):
         return any(rules)
 
     def has_object_permission(self, request, view, obj):
-
         rules = [
             request.user.is_superuser,
             request.method in permissions.SAFE_METHODS
@@ -76,6 +77,7 @@ class IsStandardUser(IsGuest):
     Object-level permission to only allow owners of an object to edit it.
     Assumes the model instance has an `owner` attribute.
     """
+
     def has_permission(self, request, view):
         rules = [
             super().has_permission(request, view)
@@ -148,6 +150,7 @@ class IsCountryAdmin(IsStandardUser):
         Object-level permission to only allow owners of an object to edit it.
         Assumes the model instance has an `owner` attribute.
     """
+
     def has_permission(self, request, view):
 
         rules = [
@@ -234,6 +237,24 @@ class IsCommentModerator(IsStandardUser):
 
 class IsEstablishmentManager(IsStandardUser):
 
+    def has_permission(self, request, view):
+        rules = [
+            super().has_permission(request, view)
+        ]
+
+        # and request.user.email_confirmed,
+        if hasattr(request.data, 'user') and hasattr(request.data, 'establishment_id'):
+            role = Role.objects.filter(role=Role.ESTABLISHMENT_MANAGER) \
+                .first()  # 'Comments moderator'
+
+            rules = [
+                UserRole.objects.filter(user=request.user, role=role,
+                                        establishment_id=request.data.establishment_id
+                                        ).exists(),
+                super().has_permission(request, view)
+            ]
+        return any(rules)
+
     def has_object_permission(self, request, view, obj):
         role = Role.objects.filter(role=Role.ESTABLISHMENT_MANAGER) \
             .first()  # 'Comments moderator'
@@ -250,8 +271,25 @@ class IsEstablishmentManager(IsStandardUser):
 
 class IsReviewerManager(IsStandardUser):
 
-    def has_object_permission(self, request, view, obj):
+    def has_permission(self, request, view):
+        rules = [
+            super().has_permission(request, view)
+        ]
 
+        # and request.user.email_confirmed,
+        if hasattr(request.data, 'user') and hasattr(request.data, 'country_id'):
+            role = Role.objects.filter(role=Role.REVIEWER_MANGER) \
+                .first()  # 'Comments moderator'
+
+            rules = [
+                UserRole.objects.filter(user=request.user, role=role,
+                                        establishment_id=request.data.country_id
+                                        ).exists(),
+                super().has_permission(request, view)
+            ]
+        return any(rules)
+
+    def has_object_permission(self, request, view, obj):
         role = Role.objects.filter(role=Role.REVIEWER_MANGER,
                                    country_id=obj.country_id) \
             .first()
@@ -266,8 +304,25 @@ class IsReviewerManager(IsStandardUser):
 
 class IsRestaurantReviewer(IsStandardUser):
 
-    def has_object_permission(self, request, view, obj):
+    def has_permission(self, request, view):
+        rules = [
+            super().has_permission(request, view)
+        ]
 
+        # and request.user.email_confirmed,
+        if hasattr(request.data, 'user') and hasattr(request.data, 'object_id'):
+            role = Role.objects.filter(role=Role.RESTAURANT_REVIEWER) \
+                .first()  # 'Comments moderator'
+
+            rules = [
+                UserRole.objects.filter(user=request.user, role=role,
+                                        establishment_id=request.data.object_id
+                                        ).exists(),
+                super().has_permission(request, view)
+            ]
+        return any(rules)
+
+    def has_object_permission(self, request, view, obj):
         content_type = ContentType.objects.get(app_lable='establishment',
                                                model='establishment')