Add required_alternate_scopes to authenticated views

Declares the HTTP methods each authenticated view/viewset exposes,
scoped to empty scope requirements, ready for OAuth2 scope enforcement.

apps/catalog/views.py

@@ -61,6 +61,13 @@ class SellerProductViewSet(viewsets.ModelViewSet):
 
     schema_tags = ['Seller · Products']
     permission_classes = [IsAuthenticated, IsStoreOwner]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+        "PUT": [[]],
+        "PATCH": [[]],
+        "DELETE": [[]],
+    }
     serializer_class = SellerProductSerializer
 
     def get_queryset(self):

apps/locations/views.py

@@ -29,6 +29,13 @@ class NeighborhoodViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, view
 class AddressViewSet(viewsets.ModelViewSet):
     schema_tags = ['Addresses']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+        "PUT": [[]],
+        "PATCH": [[]],
+        "DELETE": [[]],
+    }
     serializer_class = AddressSerializer
 
     def get_queryset(self):

apps/orders/views.py

@@ -28,6 +28,10 @@ class CartView(APIView):
 
     schema_tags = ['Cart']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "DELETE": [[]],
+    }
     serializer_class = CartSerializer
 
     def get(self, request):
@@ -46,6 +50,11 @@ class CartItemView(APIView):
 
     schema_tags = ['Cart']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "POST": [[]],
+        "PATCH": [[]],
+        "DELETE": [[]],
+    }
     serializer_class = CartItemWriteSerializer
 
     @extend_schema(request=CartItemWriteSerializer, responses=CartItemSerializer)
@@ -87,6 +96,9 @@ class CheckoutView(APIView):
 
     schema_tags = ['Checkout']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "POST": [[]],
+    }
     serializer_class = CheckoutSerializer
 
     @extend_schema(request=CheckoutSerializer, responses=OrderGroupSerializer)
@@ -103,6 +115,9 @@ class OrderGroupViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, viewse
 
     schema_tags = ['Orders']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+    }
     serializer_class = OrderGroupSerializer
 
     def get_queryset(self):
@@ -116,6 +131,10 @@ class OrderViewSet(mixins.RetrieveModelMixin, viewsets.GenericViewSet):
 
     schema_tags = ['Orders']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+    }
     serializer_class = OrderSerializer
 
     def get_queryset(self):
@@ -137,6 +156,10 @@ class SellerOrderViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, views
 
     schema_tags = ['Seller · Orders']
     permission_classes = [IsAuthenticated, IsStoreOwner]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+    }
     serializer_class = OrderSerializer
 
     def get_queryset(self):
@@ -185,6 +208,10 @@ class NotificationViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, view
 
     schema_tags = ['Notifications']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+    }
     serializer_class = NotificationSerializer
 
     def get_queryset(self):

apps/reviews/views.py

@@ -14,6 +14,9 @@ class ReviewViewSet(mixins.ListModelMixin, mixins.CreateModelMixin, viewsets.Gen
 
     schema_tags = ['Reviews']
     serializer_class = ReviewSerializer
+    required_alternate_scopes = {
+        "POST": [[]],
+    }
 
     def get_permissions(self):
         if self.action == 'create':
@@ -33,6 +36,10 @@ class SellerReviewViewSet(mixins.ListModelMixin, viewsets.GenericViewSet):
 
     schema_tags = ['Seller · Reviews']
     permission_classes = [IsAuthenticated, IsStoreOwner]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+    }
     serializer_class = ReviewSerializer
 
     def get_queryset(self):

apps/stores/views.py

@@ -71,6 +71,11 @@ class SellerStoreView(APIView):
 
     schema_tags = ['Seller · Store']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+        "PATCH": [[]],
+    }
     serializer_class = SellerStoreSerializer
 
     def get(self, request):
@@ -103,6 +108,10 @@ class SellerStoreWorkingHoursView(APIView):
 
     schema_tags = ['Seller · Store']
     permission_classes = [IsAuthenticated, IsStoreOwner]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "PUT": [[]],
+    }
     serializer_class = StoreWorkingHoursSerializer
 
     def get(self, request):