Method has_permission

api/projects/permissions.py:14–49

Check if user has permission to list / create project

(self, request, view)

class ProjectPermissions(IsAuthenticated):
    def has_permission(self, request, view):  # type: ignore[no-untyped-def]
        """Check if user has permission to list / create project"""
        if not super().has_permission(request, view):
            return False

        if view.action == "create" and request.user.belongs_to(
            int(request.data.get("organisation"))
        ):
            organisation = Organisation.objects.select_related("subscription").get(
                id=int(request.data.get("organisation"))
            )

            # Allow project creation based on the active subscription
            subscription_metadata = (
                organisation.subscription.get_subscription_metadata()
            )

            total_projects_created = Project.objects.filter(
                organisation=organisation
            ).count()
            if (
                subscription_metadata.projects
                and total_projects_created >= subscription_metadata.projects
                and getattr(request, "is_e2e", False) is not True
            ):
                return False
            if organisation.restrict_project_create_to_admin:
                return request.user.is_organisation_admin(organisation.pk)
            return request.user.has_organisation_permission(
                organisation, CREATE_PROJECT
            )
        if view.action in ("list", "permissions", "get_by_uuid"):
            return True

        # move on to object specific permissions
        return view.detail

    def has_object_permission(self, request, view, obj):  # type: ignore[no-untyped-def]
        """Check if user has permission to view / edit / delete project"""