Permissons

app/career/factories/__init__.py

@@ -1 +1,2 @@
 from app.career.factories.weekly_business_factory import WeeklyBusinessFactory
+from app.career.factories.job_post_factory import JobPostFactory

app/career/factories/job_post_factory.py

@@ -0,0 +1,17 @@
+import factory
+from factory.django import DjangoModelFactory
+
+from app.career.models import JobPost
+
+
+class JobPostFactory(DjangoModelFactory):
+    class Meta:
+        model = JobPost
+
+    title = factory.Faker("sentence", nb_words=4)
+    ingress = factory.Faker("sentence", nb_words=10)
+    body = factory.Faker("text")
+    location = factory.Faker("city")
+    deadline = factory.Faker("date_time")
+    company = factory.Faker("company")
+    email = factory.Faker("email")

app/career/models/__init__.py

@@ -1 +1,2 @@
 from app.career.models.weekly_business import WeeklyBusiness
+from app.career.models.job_post import JobPost

app/career/models/job_post.py

@@ -2,7 +2,7 @@
 
 from app.career.enums import JobPostType
 from app.common.enums import AdminGroup
-from app.common.permissions import BasePermissionModel
+from app.common.permissions import BasePermissionModel, check_has_access
 from app.content.enums import UserClass
 from app.util.models import BaseModel, OptionalImage
 from app.util.utils import yesterday
@@ -31,13 +31,33 @@ class JobPost(BaseModel, OptionalImage, BasePermissionModel):
 
     write_access = [AdminGroup.HS, AdminGroup.INDEX, AdminGroup.NOK]
 
+    def __str__(self):
+        return f"JobPost: {self.company}  - {self.title}"
+
     @property
     def expired(self):
         return self.deadline <= yesterday()
 
-    def __str__(self):
-        return f"JobPost: {self.company}  - {self.title}"
-
     @property
     def website_url(self):
         return f"/karriere/{self.id}/"
+
+    @classmethod
+    def has_read_permission(cls, request):
+        return True
+
+    @classmethod
+    def has_retrieve_permission(cls, request):
+        return True
+
+    @classmethod
+    def has_update_permission(cls, request):
+        return check_has_access(cls.write_access, request)
+
+    @classmethod
+    def has_destroy_permission(cls, request):
+        return check_has_access(cls.write_access, request)
+
+    @classmethod
+    def has_create_permission(cls, request):
+        return check_has_access(cls.write_access, request)

app/common/permissions.py

@@ -44,7 +44,9 @@ def has_object_permission(self, request, view, obj):
 
 
 def check_has_access(groups_with_access, request):
-    set_user_id(request)
+    if not len(groups_with_access):
+        return True
+
     user = request.user
 
     try:
@@ -61,6 +63,14 @@ def check_has_access(groups_with_access, request):
 
 
 def set_user_id(request):
+    if (
+        hasattr(request, "user")
+        and request.user is None
+        and hasattr(request, "id")
+        and request.id is None
+    ):
+        return
+
     token = request.META.get("HTTP_X_CSRF_TOKEN")
     request.id = None
     request.user = None

app/communication/models/notification.py

@@ -1,10 +1,12 @@
 from django.db import models
 
+from app.common.enums import Groups
+from app.common.permissions import BasePermissionModel, check_has_access
 from app.content.models.user import User
 from app.util.models import BaseModel
 
 
-class Notification(BaseModel):
+class Notification(BaseModel, BasePermissionModel):
     user = models.ForeignKey(
         User, on_delete=models.CASCADE, related_name="notifications"
     )
@@ -13,27 +15,39 @@ class Notification(BaseModel):
     link = models.CharField(max_length=150, blank=True, null=True)
     read = models.BooleanField(default=False)
 
+    read_access = (Groups.TIHLDE,)
+    write_access = (Groups.TIHLDE,)
+
     def __str__(self):
         return f"Notification for {self.user}, title: {self.title}, description: {self.description}"
 
+    @classmethod
+    def has_write_permission(cls, request):
+        if request.method == "POST":
+            return False
+        return check_has_access(cls.write_access, request)
+
     @classmethod
     def has_read_permission(cls, request):
-        return request.user is not None
+        return check_has_access(cls.read_access, request)
 
-    def has_object_read_permission(self, request):
-        if request.user is None:
-            return False
-        return self.user == request.user
+    @classmethod
+    def has_retrieve_permission(cls, request):
+        return check_has_access(cls.read_access, request)
 
     @classmethod
-    def has_write_permission(cls, request):
-        if request.user is None:
-            return False
-        return request.method == "PUT"
+    def has_update_permission(cls, request):
+        return check_has_access(cls.write_access, request)
 
-    def has_object_write_permission(self, request):
-        if request.user is None:
-            return False
-        if request.method == "PUT":
-            return self.user == request.user
+    @classmethod
+    def has_destroy_permission(cls, request):
         return False
+
+    def has_object_read_permission(self, request):
+        return self.user == request.user
+
+    def has_object_retrieve_permission(self, request):
+        return self.user == request.user
+
+    def has_object_update_permission(self, request):
+        return self.user == request.user

app/communication/models/user_notification_setting.py

@@ -54,3 +54,15 @@ def has_object_write_permission(self, request):
         if request.user is None:
             return False
         return self.user == request.user
+
+    @classmethod
+    def has_retrieve_permission(cls, request):
+        return request.user is not None
+
+    @classmethod
+    def has_update_permission(cls, request):
+        return request.user is not None
+
+    @classmethod
+    def has_destroy_permission(cls, request):
+        return request.user is not None

app/communication/models/warning.py

@@ -1,7 +1,7 @@
 from django.db import models
 
 from app.common.enums import AdminGroup
-from app.common.permissions import BasePermissionModel
+from app.common.permissions import BasePermissionModel, check_has_access
 from app.util.models import BaseModel
 
 
@@ -18,3 +18,23 @@ class Warning(BaseModel, BasePermissionModel):
 
     def __str__(self):
         return f"Warning: {self.type} - Text: {self.text}"
+
+    @classmethod
+    def has_write_permission(cls, request):
+        return check_has_access(cls.write_access, request)
+
+    @classmethod
+    def has_read_permission(cls, request):
+        return check_has_access(cls.read_access, request)
+
+    @classmethod
+    def has_update_permission(cls, request):
+        return check_has_access(cls.write_access, request)
+
+    @classmethod
+    def has_destroy_permission(cls, request):
+        return check_has_access(cls.write_access, request)
+
+    @classmethod
+    def has_retrieve_permission(cls, request):
+        return check_has_access(cls.read_access, request)

app/communication/serializers/__init__.py

@@ -2,6 +2,7 @@
 from app.communication.serializers.notification import (
     NotificationSerializer,
     UpdateNotificationSerializer,
+    CreateNotificationSerializer,
 )
 from app.communication.serializers.user_notification_setting import (
     UserNotificationSettingSerializer,

app/communication/serializers/notification.py

@@ -17,3 +17,9 @@ def update(self, instance, validated_data):
         is_read = validated_data.get("read", instance.read)
 
         return super().update(instance, dict(read=is_read))
+
+
+class CreateNotificationSerializer(BaseModelSerializer):
+    class Meta:
+        model = Notification
+        fields = ["title", "description", "link"]

app/communication/views/notification.py

@@ -7,6 +7,7 @@
 from app.common.viewsets import BaseViewSet
 from app.communication.models import Notification
 from app.communication.serializers import (
+    CreateNotificationSerializer,
     NotificationSerializer,
     UpdateNotificationSerializer,
 )
@@ -22,9 +23,25 @@ class NotificationViewSet(BaseViewSet):
     def get_queryset(self):
         return self.request.user.notifications.all().order_by("-created_at")
 
+    def create(self, request):
+        user = request.user
+        serializer = CreateNotificationSerializer(
+            data=request.data, context={"request": request}
+        )
+        if serializer.is_valid():
+            notification = super().perform_create(serializer, user=user)
+            serializer = NotificationSerializer(notification)
+            return Response(
+                serializer.data,
+                status=status.HTTP_201_CREATED,
+            )
+        return Response(
+            serializer.errors,
+            status=status.HTTP_400_BAD_REQUEST,
+        )
+
     def update(self, request, pk):
         notification = get_object_or_404(Notification, id=pk)
-        self.check_object_permissions(self.request, notification)
         serializer = UpdateNotificationSerializer(
             notification, data=request.data, context={"request": request}
         )

app/content/factories/__init__.py

@@ -10,5 +10,6 @@
 from app.content.factories.toddel_factory import ToddelFactory
 from app.content.factories.priority_pool_factory import PriorityPoolFactory
 from app.content.factories.qr_code_factory import QRCodeFactory
+from app.content.factories.category_factory import CategoryFactory
 from app.content.factories.logentry_factory import LogEntryFactory
 from app.content.factories.minute_factory import MinuteFactory

app/content/factories/category_factory.py

@@ -0,0 +1,13 @@
+import factory
+from factory.django import DjangoModelFactory
+
+from app.content.models import Category
+
+
+class CategoryFactory(DjangoModelFactory):
+    """Factory that creates a generic category"""
+
+    class Meta:
+        model = Category
+
+    text = factory.Faker("word")

app/content/factories/qr_code_factory.py

@@ -11,4 +11,4 @@ class Meta:
 
     name = factory.Sequence(lambda n: f"QRCode {n}")
     user = factory.SubFactory(UserFactory)
-    image = "https://tihldestorage.blob.core.windows.net/imagepng/0331423a-11b3-4e6b-a505-f84e0991b696TestCode"
+    content = "https://tihlde.org"

app/content/models/category.py

@@ -1,16 +1,41 @@
 from django.db import models
 
-from app.common.enums import AdminGroup
-from app.common.permissions import BasePermissionModel
+from app.common.enums import AdminGroup, Groups
+from app.common.permissions import BasePermissionModel, check_has_access
 from app.util.models import BaseModel
 
 
 class Category(BaseModel, BasePermissionModel):
     write_access = AdminGroup.all()
+    read_access = (Groups.TIHLDE,)
     text = models.CharField(max_length=200, null=True)
 
     class Meta:
         verbose_name_plural = "Categories"
 
     def __str__(self):
         return f"{self.text}"
+
+    @classmethod
+    def has_read_permission(cls, request):
+        return check_has_access(cls.read_access, request)
+
+    @classmethod
+    def has_retrieve_permission(cls, request):
+        return check_has_access(cls.read_access, request)
+
+    @classmethod
+    def has_write_permission(cls, request):
+        return check_has_access(cls.write_access, request)
+
+    @classmethod
+    def has_create_permission(cls, request):
+        return check_has_access(cls.write_access, request)
+
+    @classmethod
+    def has_update_permission(cls, request):
+        return check_has_access(cls.write_access, request)
+
+    @classmethod
+    def has_destroy_permission(cls, request):
+        return check_has_access(cls.write_access, request)

app/content/models/cheatsheet.py

@@ -11,7 +11,7 @@
     UserClass,
     UserStudy,
 )
-from app.common.permissions import BasePermissionModel
+from app.common.permissions import BasePermissionModel, check_has_access
 from app.util.models import BaseModel
 
 
@@ -34,3 +34,23 @@ class Meta:
 
     def __str__(self):
         return f"{self.title} {self.course}"
+
+    @classmethod
+    def has_read_permission(cls, request):
+        return check_has_access(cls.read_access, request)
+
+    @classmethod
+    def has_retrieve_permission(cls, request):
+        return check_has_access(cls.read_access, request)
+
+    @classmethod
+    def has_create_permission(cls, request):
+        return check_has_access(cls.write_access, request)
+
+    @classmethod
+    def has_update_permission(cls, request):
+        return check_has_access(cls.write_access, request)
+
+    @classmethod
+    def has_destroy_permission(cls, request):
+        return check_has_access(cls.write_access, request)