From 674ca34041955f1ad0631ab94addb6ccbd7db853 Mon Sep 17 00:00:00 2001
From: Ali Asadi <asadyali80@gmail.com>
Date: Mon, 31 Aug 2026 14:46:02 +0330
Subject: [PATCH] Add missing required_alternate_scopes across OAS-gated views

Several views using IsAuthenticatedOrTokenMatchesOASRequirements were
missing scope entries for methods they actually expose (GET on
list/retrieve-only viewsets, PUT/PATCH/DELETE on ModelViewSets), and
two had a stale POST entry for a method that doesn't exist
(SellerStoreWorkingHoursView, OrderGroupViewSet). Fixes:
- SellerStoreView, SellerStoreWorkingHoursView (apps/stores/views.py)
- AddressViewSet (apps/locations/views.py)
- SellerReviewViewSet (apps/reviews/views.py)
- SellerProductViewSet (apps/catalog/views.py)
- OrderGroupViewSet, OrderViewSet, SellerOrderViewSet,
  NotificationViewSet (apps/orders/views.py)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 apps/catalog/views.py   | 4 ++++
 apps/locations/views.py | 4 ++++
 apps/orders/views.py    | 5 ++++-
 apps/reviews/views.py   | 1 +
 apps/stores/views.py    | 5 ++++-
 5 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/apps/catalog/views.py b/apps/catalog/views.py
index 4474c83..d139298 100644
--- a/apps/catalog/views.py
+++ b/apps/catalog/views.py
@@ -51,7 +51,11 @@ class SellerProductViewSet(viewsets.ModelViewSet):
     # TODO: IsStoreOwner?
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
+        "PUT": [[]],
+        "PATCH": [[]],
+        "DELETE": [[]],
     }
 
     def get_queryset(self):
diff --git a/apps/locations/views.py b/apps/locations/views.py
index ea09874..f45f3e0 100644
--- a/apps/locations/views.py
+++ b/apps/locations/views.py
@@ -29,7 +29,11 @@ class AddressViewSet(viewsets.ModelViewSet):
     serializer_class = AddressSerializer
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
+        "PUT": [[]],
+        "PATCH": [[]],
+        "DELETE": [[]],
     }
 
     def get_queryset(self):
diff --git a/apps/orders/views.py b/apps/orders/views.py
index d94be57..c418b68 100644
--- a/apps/orders/views.py
+++ b/apps/orders/views.py
@@ -129,7 +129,7 @@ class OrderGroupViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, viewse
     serializer_class = OrderGroupSerializer
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
-        "POST": [[]],
+        "GET": [[]],
     }
 
     def get_queryset(self):
@@ -145,6 +145,7 @@ class OrderViewSet(mixins.RetrieveModelMixin, viewsets.GenericViewSet):
     serializer_class = OrderSerializer
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
     }
 
@@ -171,6 +172,7 @@ class SellerOrderViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, views
     # TODO: IsStoreOwner
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
     }
     filterset_fields = ['status']
@@ -219,6 +221,7 @@ class NotificationViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, view
     serializer_class = NotificationSerializer
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
     }
 
diff --git a/apps/reviews/views.py b/apps/reviews/views.py
index f2f4746..7f279ab 100644
--- a/apps/reviews/views.py
+++ b/apps/reviews/views.py
@@ -38,6 +38,7 @@ class SellerReviewViewSet(mixins.ListModelMixin, viewsets.GenericViewSet):
     # TODO:
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
     }
 
diff --git a/apps/stores/views.py b/apps/stores/views.py
index aab11e7..c648f46 100644
--- a/apps/stores/views.py
+++ b/apps/stores/views.py
@@ -72,7 +72,9 @@ class SellerStoreView(APIView):
     serializer_class = SellerStoreSerializer
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
+        "PATCH": [[]],
     }
 
     def get(self, request):
@@ -109,7 +111,8 @@ class SellerStoreWorkingHoursView(APIView):
     # TODO:
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
-        "POST": [[]],
+        "GET": [[]],
+        "PUT": [[]],
     }
 
     def get(self, request):
-- 
2.45.3