From 23eb0fc2f0e8d00ad8eb246dcac1b9230311759a Mon Sep 17 00:00:00 2001
From: Ali Asadi <asadyali80@gmail.com>
Date: Sat, 15 Aug 2026 11:48:35 +0330
Subject: [PATCH] Add required_alternate_scopes to authenticated views

Declares the HTTP methods each authenticated view/viewset exposes,
scoped to empty scope requirements, ready for OAuth2 scope enforcement.
---
 apps/catalog/views.py   |  7 +++++++
 apps/locations/views.py |  7 +++++++
 apps/orders/views.py    | 27 +++++++++++++++++++++++++++
 apps/reviews/views.py   |  7 +++++++
 apps/stores/views.py    |  9 +++++++++
 5 files changed, 57 insertions(+)

diff --git a/apps/catalog/views.py b/apps/catalog/views.py
index 4073713..6bd17f7 100644
--- a/apps/catalog/views.py
+++ b/apps/catalog/views.py
@@ -61,6 +61,13 @@ class SellerProductViewSet(viewsets.ModelViewSet):
 
     schema_tags = ['Seller · Products']
     permission_classes = [IsAuthenticated, IsStoreOwner]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+        "PUT": [[]],
+        "PATCH": [[]],
+        "DELETE": [[]],
+    }
     serializer_class = SellerProductSerializer
 
     def get_queryset(self):
diff --git a/apps/locations/views.py b/apps/locations/views.py
index 6e9ab39..18c1db4 100644
--- a/apps/locations/views.py
+++ b/apps/locations/views.py
@@ -29,6 +29,13 @@ class NeighborhoodViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, view
 class AddressViewSet(viewsets.ModelViewSet):
     schema_tags = ['Addresses']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+        "PUT": [[]],
+        "PATCH": [[]],
+        "DELETE": [[]],
+    }
     serializer_class = AddressSerializer
 
     def get_queryset(self):
diff --git a/apps/orders/views.py b/apps/orders/views.py
index 8a2aaa6..a9997f1 100644
--- a/apps/orders/views.py
+++ b/apps/orders/views.py
@@ -28,6 +28,10 @@ class CartView(APIView):
 
     schema_tags = ['Cart']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "DELETE": [[]],
+    }
     serializer_class = CartSerializer
 
     def get(self, request):
@@ -46,6 +50,11 @@ class CartItemView(APIView):
 
     schema_tags = ['Cart']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "POST": [[]],
+        "PATCH": [[]],
+        "DELETE": [[]],
+    }
     serializer_class = CartItemWriteSerializer
 
     @extend_schema(request=CartItemWriteSerializer, responses=CartItemSerializer)
@@ -87,6 +96,9 @@ class CheckoutView(APIView):
 
     schema_tags = ['Checkout']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "POST": [[]],
+    }
     serializer_class = CheckoutSerializer
 
     @extend_schema(request=CheckoutSerializer, responses=OrderGroupSerializer)
@@ -103,6 +115,9 @@ class OrderGroupViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, viewse
 
     schema_tags = ['Orders']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+    }
     serializer_class = OrderGroupSerializer
 
     def get_queryset(self):
@@ -116,6 +131,10 @@ class OrderViewSet(mixins.RetrieveModelMixin, viewsets.GenericViewSet):
 
     schema_tags = ['Orders']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+    }
     serializer_class = OrderSerializer
 
     def get_queryset(self):
@@ -137,6 +156,10 @@ class SellerOrderViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, views
 
     schema_tags = ['Seller · Orders']
     permission_classes = [IsAuthenticated, IsStoreOwner]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+    }
     serializer_class = OrderSerializer
 
     def get_queryset(self):
@@ -185,6 +208,10 @@ class NotificationViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, view
 
     schema_tags = ['Notifications']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+    }
     serializer_class = NotificationSerializer
 
     def get_queryset(self):
diff --git a/apps/reviews/views.py b/apps/reviews/views.py
index f3c9ca0..3a1be68 100644
--- a/apps/reviews/views.py
+++ b/apps/reviews/views.py
@@ -14,6 +14,9 @@ class ReviewViewSet(mixins.ListModelMixin, mixins.CreateModelMixin, viewsets.Gen
 
     schema_tags = ['Reviews']
     serializer_class = ReviewSerializer
+    required_alternate_scopes = {
+        "POST": [[]],
+    }
 
     def get_permissions(self):
         if self.action == 'create':
@@ -33,6 +36,10 @@ class SellerReviewViewSet(mixins.ListModelMixin, viewsets.GenericViewSet):
 
     schema_tags = ['Seller · Reviews']
     permission_classes = [IsAuthenticated, IsStoreOwner]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+    }
     serializer_class = ReviewSerializer
 
     def get_queryset(self):
diff --git a/apps/stores/views.py b/apps/stores/views.py
index 8c7d130..937bfe9 100644
--- a/apps/stores/views.py
+++ b/apps/stores/views.py
@@ -71,6 +71,11 @@ class SellerStoreView(APIView):
 
     schema_tags = ['Seller · Store']
     permission_classes = [IsAuthenticated]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "POST": [[]],
+        "PATCH": [[]],
+    }
     serializer_class = SellerStoreSerializer
 
     def get(self, request):
@@ -103,6 +108,10 @@ class SellerStoreWorkingHoursView(APIView):
 
     schema_tags = ['Seller · Store']
     permission_classes = [IsAuthenticated, IsStoreOwner]
+    required_alternate_scopes = {
+        "GET": [[]],
+        "PUT": [[]],
+    }
     serializer_class = StoreWorkingHoursSerializer
 
     def get(self, request):