U ƽb#@sdZddlmZddlmZdZGdddZGdddeZGd d d eZGd d d Z Gd ddZ GdddZ Gdddee Z Gddde dZGdddeZGdddeZGdddeZGdddeZGdddeZGd d!d!eZGd"d#d#eZd$S)%z2 Provides a set of pluggable permission policies. )Http404) exceptions)GETHEADOPTIONSc@s4eZdZddZddZddZddZd d Zd S) OperationHolderMixincCs tt||SN OperandHolderANDselfotherr>/tmp/pip-unpacked-wheel-iohwuy7z/rest_framework/permissions.py__and__ szOperationHolderMixin.__and__cCs tt||Srr ORr rrr__or__szOperationHolderMixin.__or__cCs tt||Srr r rrr__rand__szOperationHolderMixin.__rand__cCs tt||Srrr rrr__ror__szOperationHolderMixin.__ror__cCs tt|Sr)SingleOperandHolderNOT)r rrr __invert__szOperationHolderMixin.__invert__N)__name__ __module__ __qualname__rrrrrrrrrr s rc@seZdZddZddZdS)rcCs||_||_dSr)operator_class op1_class)r rrrrr__init__szSingleOperandHolder.__init__cOs|j||}||Sr)rr)r argskwargsop1rrr__call__!s zSingleOperandHolder.__call__Nrrrrr#rrrrrsrc@seZdZddZddZdS)r cCs||_||_||_dSr)rr op2_class)r rrr%rrrr'szOperandHolder.__init__cOs$|j||}|j||}|||Sr)rr%r)r r r!r"op2rrrr#,s  zOperandHolder.__call__Nr$rrrrr &sr c@s$eZdZddZddZddZdS)r cCs||_||_dSrr"r&r r"r&rrrr3sz AND.__init__cCs|j||o|j||Srr"has_permissionr&r requestviewrrrr*7s zAND.has_permissioncCs |j|||o|j|||Srr"has_object_permissionr&r r,r-objrrrr/=szAND.has_object_permissionNrrrrr*r/rrrrr 2sr c@s$eZdZddZddZddZdS)rcCs||_||_dSrr'r(rrrrEsz OR.__init__cCs|j||p|j||Srr)r+rrrr*Is zOR.has_permissioncCs |j|||p|j|||Srr.r0rrrr/OszOR.has_object_permissionNr2rrrrrDsrc@s$eZdZddZddZddZdS)rcCs ||_dSr)r")r r"rrrrWsz NOT.__init__cCs|j|| Sr)r"r*r+rrrr*ZszNOT.has_permissioncCs|j||| Sr)r"r/r0rrrr/]szNOT.has_object_permissionNr2rrrrrVsrc@s eZdZdS)BasePermissionMetaclassN)rrrrrrrr3asr3c@s eZdZdZddZddZdS)BasePermissionzH A base class from which all permission classes should inherit. cCsdSzL Return `True` if permission is granted, `False` otherwise. Trr+rrrr*jszBasePermission.has_permissioncCsdSr5rr0rrrr/psz$BasePermission.has_object_permissionN)rrr__doc__r*r/rrrrr4esr4) metaclassc@seZdZdZddZdS)AllowAnyz Allow any access. This isn't strictly required, since you could use an empty permission_classes list, but it's useful because it makes the intention more explicit. cCsdS)NTrr+rrrr*szAllowAny.has_permissionNrrrr6r*rrrrr8wsr8c@seZdZdZddZdS)IsAuthenticatedz4 Allows access only to authenticated users. cCst|jo|jjSr)booluseris_authenticatedr+rrrr*szIsAuthenticated.has_permissionNr9rrrrr:sr:c@seZdZdZddZdS) IsAdminUserz, Allows access only to admin users. cCst|jo|jjSr)r;r<Zis_staffr+rrrr*szIsAdminUser.has_permissionNr9rrrrr>sr>c@seZdZdZddZdS)IsAuthenticatedOrReadOnlyzL The request is authenticated as a user, or is a read-only request. cCst|jtkp|jo|jjSr)r;method SAFE_METHODSr<r=r+rrrr*s  z(IsAuthenticatedOrReadOnly.has_permissionNr9rrrrr?sr?c@sHeZdZdZgggdgdgdgdgdZdZddZd d Zd d Zd S)DjangoModelPermissionsa} The request is authenticated using `django.contrib.auth` permissions. See: https://docs.djangoproject.com/en/dev/topics/auth/#permissions It ensures that the user is authenticated, and has the appropriate `add`/`change`/`delete` permissions on the model. This permission can only be applied against view classes that provide a `.queryset` attribute. %(app_label)s.add_%(model_name)s#%(app_label)s.change_%(model_name)s#%(app_label)s.delete_%(model_name)srrrPOSTPUTPATCHDELETETcs>|jj|jjd||jkr&t|fdd|j|DS)z Given a model and an HTTP method, return the list of permission codes that the user is required to have.  app_label model_namecsg|] }|qSrr.0permr!rr szCDjangoModelPermissions.get_required_permissions..Z_metarLrM perms_maprZMethodNotAllowedr r@ model_clsrrQrget_required_permissionss   z/DjangoModelPermissions.get_required_permissionscCsbt|ds,t|dddk s,td|jjt|dr\|}|dk sXtd|jj|S|jS)N get_querysetquerysetz[Cannot apply {} on a view that does not set `.queryset` or have a `.get_queryset()` method.z{}.get_queryset() returned None)hasattrgetattrAssertionErrorformat __class__rrXrY)r r-rYrrr _querysets    z DjangoModelPermissions._querysetcCsNt|ddrdS|jr$|jjs(|jr(dS||}||j|j}|j|S)NZ_ignore_model_permissionsFT) r[r<r=authenticated_users_onlyr_rWr@model has_perms)r r,r-rYpermsrrrr*s  z%DjangoModelPermissions.has_permissionN) rrrr6rTr`rWr_r*rrrrrBs rBc@seZdZdZdZdS)$DjangoModelPermissionsOrAnonReadOnlyzj Similar to DjangoModelPermissions, except that anonymous users are allowed read-only access. FN)rrrr6r`rrrrrdsrdc@s<eZdZdZgggdgdgdgdgdZddZdd Zd S) DjangoObjectPermissionsa The request is authenticated using Django's object-level permissions. It requires an object-permissions-enabled backend, such as Django Guardian. It ensures that the user is authenticated, and has the appropriate `add`/`change`/`delete` permissions on the object using .has_perms. This permission can only be applied against view classes that provide a `.queryset` attribute. rCrDrErFcs>|jj|jjd||jkr&t|fdd|j|DS)NrKcsg|] }|qSrrrNrQrrrRszKDjangoObjectPermissions.get_required_object_permissions..rSrUrrQrget_required_object_permissionss   z7DjangoObjectPermissions.get_required_object_permissionsc Csb||}|j}|j}||j|}|||s^|jtkr>t|d|}|||sZtdSdS)NrFT)r_rar<rfr@rbrAr) r r,r-r1rYrVr<rcZ read_permsrrrr/s     z-DjangoObjectPermissions.has_object_permissionN)rrrr6rTrfr/rrrrres   reN)r6Z django.httprZrest_frameworkrrArrr r rrtyper3r4r8r:r>r?rBrdrerrrrs$         I