66 lines
2.2 KiB
Python
66 lines
2.2 KiB
Python
|
from rest_framework import permissions
|
|||
|
|
|
|||
|
|
|
|||
|
|
class IsOwnerOrStaff(permissions.BasePermission):
|
|||
|
|
"""
|
|||
|
|
自定义权限：只有日报的创建者或管理员才能访问
|
|||
|
|
"""
|
|||
|
|
|
|||
|
|
def has_object_permission(self, request, view, obj):
|
|||
|
|
# 读取权限：管理员可以查看所有日报，普通用户只能查看自己的日报
|
|||
|
|
if request.method in permissions.SAFE_METHODS:
|
|||
|
|
return obj.user == request.user or request.user.is_staff
|
|||
|
|
|
|||
|
|
# 写入权限：只有创建者或管理员可以修改/删除
|
|||
|
|
return obj.user == request.user or request.user.is_staff
|
|||
|
|
|
|||
|
|
|
|||
|
|
class IsOwnerOrStaffReadOnly(permissions.BasePermission):
|
|||
|
|
"""
|
|||
|
|
自定义权限：管理员可以查看所有日报，普通用户只能查看自己的日报
|
|||
|
|
管理员对他人日报只有只读权限
|
|||
|
|
"""
|
|||
|
|
|
|||
|
|
def has_object_permission(self, request, view, obj):
|
|||
|
|
# 如果是日报创建者，拥有完全权限
|
|||
|
|
if obj.user == request.user:
|
|||
|
|
return True
|
|||
|
|
|
|||
|
|
# 如果是管理员，只有读取权限
|
|||
|
|
if request.user.is_staff:
|
|||
|
|
return request.method in permissions.SAFE_METHODS
|
|||
|
|
|
|||
|
|
# 其他情况拒绝访问
|
|||
|
|
return False
|
|||
|
|
|
|||
|
|
|
|||
|
|
class IsCommentOwnerOrStaff(permissions.BasePermission):
|
|||
|
|
"""
|
|||
|
|
评论权限：只有评论创建者或管理员可以修改/删除评论
|
|||
|
|
"""
|
|||
|
|
|
|||
|
|
def has_object_permission(self, request, view, obj):
|
|||
|
|
# 读取权限：所有认证用户都可以查看评论
|
|||
|
|
if request.method in permissions.SAFE_METHODS:
|
|||
|
|
return True
|
|||
|
|
|
|||
|
|
# 写入权限：只有评论创建者或管理员可以修改/删除
|
|||
|
|
return obj.user == request.user or request.user.is_staff
|
|||
|
|
|
|||
|
|
|
|||
|
|
class CanViewReports(permissions.BasePermission):
|
|||
|
|
"""
|
|||
|
|
日报查看权限：管理员可以查看所有日报，普通用户只能查看自己的日报
|
|||
|
|
"""
|
|||
|
|
|
|||
|
|
def has_permission(self, request, view):
|
|||
|
|
return request.user and request.user.is_authenticated
|
|||
|
|
|
|||
|
|
def has_object_permission(self, request, view, obj):
|
|||
|
|
# 管理员可以查看所有日报
|
|||
|
|
if request.user.is_staff:
|
|||
|
|
return True
|
|||
|
|
|
|||
|
|
# 普通用户只能查看自己的日报
|
|||
|
|
return obj.user == request.user
|