aboutsummaryrefslogtreecommitdiffstats
path: root/djangorestframework/permissions.py
diff options
context:
space:
mode:
Diffstat (limited to 'djangorestframework/permissions.py')
-rw-r--r--djangorestframework/permissions.py116
1 files changed, 0 insertions, 116 deletions
diff --git a/djangorestframework/permissions.py b/djangorestframework/permissions.py
deleted file mode 100644
index 3a669822..00000000
--- a/djangorestframework/permissions.py
+++ /dev/null
@@ -1,116 +0,0 @@
-"""
-The :mod:`permissions` module bundles a set of permission classes that are used
-for checking if a request passes a certain set of constraints.
-
-Permission behavior is provided by mixing the :class:`mixins.PermissionsMixin` class into a :class:`View` class.
-"""
-
-__all__ = (
- 'BasePermission',
- 'FullAnonAccess',
- 'IsAuthenticated',
- 'IsAdminUser',
- 'IsUserOrIsAnonReadOnly',
- 'PerUserThrottling',
- 'PerViewThrottling',
-)
-
-SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS']
-
-
-class BasePermission(object):
- """
- A base class from which all permission classes should inherit.
- """
- def __init__(self, view):
- """
- Permission classes are always passed the current view on creation.
- """
- self.view = view
-
- def has_permission(self, request, obj=None):
- """
- Should simply return, or raise an :exc:`response.ImmediateResponse`.
- """
- raise NotImplementedError(".has_permission() must be overridden.")
-
-
-class IsAuthenticated(BasePermission):
- """
- Allows access only to authenticated users.
- """
-
- def has_permission(self, request, obj=None):
- if request.user and request.user.is_authenticated():
- return True
- return False
-
-
-class IsAdminUser(BasePermission):
- """
- Allows access only to admin users.
- """
-
- def has_permission(self, request, obj=None):
- if request.user and request.user.is_staff:
- return True
- return False
-
-
-class IsAuthenticatedOrReadOnly(BasePermission):
- """
- The request is authenticated as a user, or is a read-only request.
- """
-
- def has_permission(self, request, obj=None):
- if (request.method in SAFE_METHODS or
- request.user and
- request.user.is_authenticated()):
- return True
- return False
-
-
-class DjangoModelPermissions(BasePermission):
- """
- The request is authenticated using `django.contrib.auth` permissions.
- See: https://docs.djangoproject.com/en/dev/topics/auth/#permissions
-
- It ensures that the user is authenticated, and has the appropriate
- `add`/`change`/`delete` permissions on the model.
-
- This permission should only be used on views with a `ModelResource`.
- """
-
- # Map methods into required permission codes.
- # Override this if you need to also provide 'view' permissions,
- # or if you want to provide custom permission codes.
- perms_map = {
- 'GET': [],
- 'OPTIONS': [],
- 'HEAD': [],
- 'POST': ['%(app_label)s.add_%(model_name)s'],
- 'PUT': ['%(app_label)s.change_%(model_name)s'],
- 'PATCH': ['%(app_label)s.change_%(model_name)s'],
- 'DELETE': ['%(app_label)s.delete_%(model_name)s'],
- }
-
- def get_required_permissions(self, method, model_cls):
- """
- Given a model and an HTTP method, return the list of permission
- codes that the user is required to have.
- """
- kwargs = {
- 'app_label': model_cls._meta.app_label,
- 'model_name': model_cls._meta.module_name
- }
- return [perm % kwargs for perm in self.perms_map[method]]
-
- def has_permission(self, request, obj=None):
- model_cls = self.view.model
- perms = self.get_required_permissions(request.method, model_cls)
-
- if (request.user and
- request.user.is_authenticated() and
- request.user.has_perms(perms, obj)):
- return True
- return False