django-pfx 1.4.dev70__tar.gz → 1.4.dev72__tar.gz

{django_pfx-1.4.dev70 → django_pfx-1.4.dev72}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: django-pfx
-Version: 1.4.dev70
+Version: 1.4.dev72
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.4.dev70 → django_pfx-1.4.dev72}/django_pfx.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: django-pfx
-Version: 1.4.dev70
+Version: 1.4.dev72
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.4.dev70 → django_pfx-1.4.dev72}/django_pfx.egg-info/SOURCES.txt

@@ -115,6 +115,7 @@ tests/urls.py
 tests/views.py
 tests/locale/fr/LC_MESSAGES/django.po
 tests/migrations/0001_initial.py
+tests/migrations/0002_alter_author_options.py
 tests/migrations/__init__.py
 tests/settings/__init__.py
 tests/settings/ci.py

{django_pfx-1.4.dev70 → django_pfx-1.4.dev72}/pfx/pfxcore/decorator/rest.py

@@ -14,8 +14,8 @@ logger = logging.getLogger(__name__)
 
 
 def rest_api(
-        path, method='get', public=None, priority=0, priority_doc=0,
-        parameters=None,
+        path, method='get', public=None, perms=None,
+        priority=0, priority_doc=0, parameters=None,
         request_schema=None, response_schema=None, filters=False,
         search=False, groups=None):
     def decorator(func):
@@ -31,7 +31,7 @@ def rest_api(
                     'HTTP_X_PRINT_REQUEST' in request.META):
                 print(format_request(request))
             try:
-                self.check_perm(public, func.__name__, *args, **kwargs)
+                self.check_perm(public, func.__name__, perms, *args, **kwargs)
                 return func(self, *args, **kwargs)
             except APIError as e:
                 return e.response

{django_pfx-1.4.dev70 → django_pfx-1.4.dev72}/pfx/pfxcore/views/rest_views.py

@@ -1325,7 +1325,7 @@ class SecuredRestViewMixin(View):
             return getattr(self, param)
         return self.default_public if public is None else public
 
-    def check_perm(self, public, func_name, *args, **kwargs):
+    def check_perm(self, public, func_name, perms, *args, **kwargs):
         """Check permissions for a specific service.
 
         Do all checks for a specific service and raise
@@ -1338,6 +1338,12 @@ class SecuredRestViewMixin(View):
             return
         if not self.request.user.is_authenticated:
             raise UnauthorizedError()
+        if isinstance(perms, str):
+            if not self.request.user.has_perm(perms):
+                raise ForbiddenError()
+        elif perms:
+            if not self.request.user.has_perms(perms):
+                raise ForbiddenError()
         if not self.perm():
             raise ForbiddenError()
         fperm = f'{func_name}_perm'

django_pfx-1.4.dev72/tests/migrations/0002_alter_author_options.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.17 on 2025-01-22 03:31
+# flake8: noqa
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('tests', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='author',
+            options={'ordering': ['last_name', 'first_name', 'pk'], 'permissions': [('can_customize_author', 'Can customize author')], 'verbose_name': 'Author', 'verbose_name_plural': 'Authors'},
+        ),
+    ]

{django_pfx-1.4.dev70 → django_pfx-1.4.dev72}/tests/models.py

@@ -89,6 +89,7 @@ class Author(CacheableMixin, JSONReprMixin, models.Model):
         verbose_name = "Author"
         verbose_name_plural = "Authors"
         ordering = ['last_name', 'first_name', 'pk']
+        permissions = [("can_customize_author", "Can customize author")]
 
     def __str__(self):
         return f"{self.first_name} {self.last_name}"

{django_pfx-1.4.dev70 → django_pfx-1.4.dev72}/tests/tests/test_permissions.py

@@ -237,3 +237,49 @@ class TestPermissions(TestAssertMixin, TestCase):
         response = self.client.get(
             f'/api/perms/books/{self.author1_book1.pk}/cover')
         self.assertRC(response, 200)
+
+    def test_custom_get_admin(self):
+        self.client.login(username='admin')
+
+        response = self.client.get('/api/perms/authors/custom')
+        self.assertRC(response, 200)
+
+    def test_custom_get_user(self):
+        self.client.login(username='user')
+
+        response = self.client.get('/api/perms/authors/custom')
+        self.assertRC(response, 403)
+
+        self.user.user_permissions.add(*permissions('tests.view_author'))
+
+        response = self.client.get('/api/perms/authors/custom')
+        self.assertRC(response, 200)
+
+    def test_custom_put_admin(self):
+        self.client.login(username='admin')
+
+        response = self.client.put('/api/perms/authors/custom')
+        self.assertRC(response, 200)
+
+    def test_custom_put_user(self):
+        self.client.login(username='user')
+
+        response = self.client.put('/api/perms/authors/custom')
+        self.assertRC(response, 403)
+
+        self.user.user_permissions.set(permissions('tests.change_author'))
+
+        response = self.client.put('/api/perms/authors/custom')
+        self.assertRC(response, 403)
+
+        self.user.user_permissions.set(permissions(
+            'tests.can_customize_author'))
+
+        response = self.client.put('/api/perms/authors/custom')
+        self.assertRC(response, 403)
+
+        self.user.user_permissions.set(permissions(
+            'tests.change_author', 'tests.can_customize_author'))
+
+        response = self.client.put('/api/perms/authors/custom')
+        self.assertRC(response, 200)

{django_pfx-1.4.dev70 → django_pfx-1.4.dev72}/tests/views.py

@@ -191,7 +191,15 @@ class PrivateAuthorRestView(AuthorRestViewMixin, RestView):
 @rest_view("/perms/authors")
 class PermsAuthorRestView(
         AuthorRestViewMixin, SlugPermsDetailRestViewMixin, PermsRestView):
-    pass
+
+    @rest_api("/custom", method="get", perms='tests.view_author')
+    def get_custom(self):
+        return JsonResponse(dict(message='Custom get'))
+
+    @rest_api("/custom", method="put", perms=[
+        'tests.change_author', 'tests.can_customize_author'])
+    def get_custom_action(self):
+        return JsonResponse(dict(message='Custom put'))
 
 
 @rest_view("/admin-edit/authors")