(self, request, view)
| 9 | |
| 10 | class MetadataFieldPermissions(IsAuthenticated): |
| 11 | def has_permission(self, request, view): # type: ignore[no-untyped-def] |
| 12 | if not super().has_permission(request, view): |
| 13 | return False |
| 14 | |
| 15 | # list is handled by the view |
| 16 | if view.action == "list" or view.detail: |
| 17 | return True |
| 18 | |
| 19 | if view.action == "create": |
| 20 | with suppress(Organisation.DoesNotExist): |
| 21 | organisation_id = request.data.get("organisation") |
| 22 | organisation = Organisation.objects.get(id=organisation_id) |
| 23 | |
| 24 | if request.user.is_organisation_admin(organisation): |
| 25 | return True |
| 26 | |
| 27 | project_id = request.data.get("project") |
| 28 | if project_id is not None: |
| 29 | with suppress(Project.DoesNotExist): |
| 30 | project = Project.objects.get(id=project_id) |
| 31 | if project.organisation_id == organisation.id: |
| 32 | return request.user.is_project_admin(project) |
| 33 | |
| 34 | return False |
| 35 | |
| 36 | def has_object_permission(self, request, view, obj): # type: ignore[no-untyped-def] |
| 37 | if view.action in ("retrieve"): |
no test coverage detected