phzhik/kwork-poizonstore
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- DISABLE_PERMISSIONS

Browse Source
This commit is contained in:
Phil Zhitnikov 2024-05-20 23:05:27 +04:00
parent e571cf9597
commit eb4b29dfdf
2 changed files with 2 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
poizonstore/settings.py
View File

@ -52,7 +52,6 @@ TG_BOT_TOKEN = get_secret("TG_BOT_TOKEN")
# SECURITY WARNING: don't run with debug turned on in production! # SECURITY WARNING: don't run with debug turned on in production!
DEBUG = bool(int(os.environ.get("DJANGO_DEBUG") or 0)) DEBUG = bool(int(os.environ.get("DJANGO_DEBUG") or 0))
DISABLE_PERMISSIONS = False
DISABLE_CORS = True DISABLE_CORS = True
ALLOWED_HOSTS = get_secret('ALLOWED_HOSTS').split(',') ALLOWED_HOSTS = get_secret('ALLOWED_HOSTS').split(',')
@ -175,9 +174,6 @@ REST_FRAMEWORK = {
# or allow read-only access for unauthenticated users. # or allow read-only access for unauthenticated users.
'DEFAULT_PERMISSION_CLASSES': [ 'DEFAULT_PERMISSION_CLASSES': [
'rest_framework.permissions.IsAuthenticated' 'rest_framework.permissions.IsAuthenticated'
if not DISABLE_PERMISSIONS
else
'rest_framework.permissions.AllowAny'
], ],
'DEFAULT_AUTHENTICATION_CLASSES': ['rest_framework.authentication.TokenAuthentication'], 'DEFAULT_AUTHENTICATION_CLASSES': ['rest_framework.authentication.TokenAuthentication'],

10
store/views.py
View File

@ -36,12 +36,6 @@ def prepare_external_response(r: requests.Response):
return Response(data) return Response(data)
class DisablePermissionsMixin(generics.GenericAPIView):
def get_permissions(self):
if settings.DISABLE_PERMISSIONS:
return [permissions.AllowAny()]
return super().get_permissions()
""" """
- managers can create/edit/delete orders - managers can create/edit/delete orders
@ -141,7 +135,7 @@ class GlobalSettingsAPI(generics.RetrieveUpdateAPIView):
permission_classes = [IsManager | ReadOnly] permission_classes = [IsManager | ReadOnly]
def get_serializer_class(self): def get_serializer_class(self):
if getattr(self.request.user, 'is_manager', False) or settings.DISABLE_PERMISSIONS: if getattr(self.request.user, 'is_manager', False):
return GlobalSettingsSerializer return GlobalSettingsSerializer
# Anonymous users can view only a certain set of fields # Anonymous users can view only a certain set of fields
@ -199,7 +193,7 @@ class GiftAPI(viewsets.ModelViewSet):
filterset_class = GiftFilter filterset_class = GiftFilter
def get_queryset(self): def get_queryset(self):
if getattr(self.request.user, 'is_manager', False) or settings.DISABLE_PERMISSIONS: if getattr(self.request.user, 'is_manager', False):
return Gift.objects.all() return Gift.objects.all()
# For anonymous users, show only available gifts # For anonymous users, show only available gifts