Ali Asadi
674ca34041
Several views using IsAuthenticatedOrTokenMatchesOASRequirements were missing scope entries for methods they actually expose (GET on list/retrieve-only viewsets, PUT/PATCH/DELETE on ModelViewSets), and two had a stale POST entry for a method that doesn't exist (SellerStoreWorkingHoursView, OrderGroupViewSet). Fixes: - SellerStoreView, SellerStoreWorkingHoursView (apps/stores/views.py) - AddressViewSet (apps/locations/views.py) - SellerReviewViewSet (apps/reviews/views.py) - SellerProductViewSet (apps/catalog/views.py) - OrderGroupViewSet, OrderViewSet, SellerOrderViewSet, NotificationViewSet (apps/orders/views.py) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
42 lines
1.5 KiB
Python
42 lines
1.5 KiB
Python
from rest_framework import mixins, viewsets
|
|
from rest_framework.permissions import AllowAny, IsAuthenticated
|
|
|
|
from apps.gooyal_oauth2.rest_framework import IsAuthenticatedOrTokenMatchesOASRequirements
|
|
|
|
from .filters import CityFilter, NeighborhoodFilter
|
|
from .models import Address, City, Neighborhood
|
|
from .serializers import AddressSerializer, CitySerializer, NeighborhoodSerializer
|
|
|
|
|
|
class CityViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, viewsets.GenericViewSet):
|
|
schema_tags = ['Locations']
|
|
permission_classes = [AllowAny]
|
|
serializer_class = CitySerializer
|
|
queryset = City.objects.filter(is_active=True)
|
|
filterset_class = CityFilter
|
|
|
|
|
|
class NeighborhoodViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, viewsets.GenericViewSet):
|
|
schema_tags = ['Locations']
|
|
permission_classes = [AllowAny]
|
|
serializer_class = NeighborhoodSerializer
|
|
queryset = Neighborhood.objects.filter(is_active=True).select_related('city')
|
|
filterset_class = NeighborhoodFilter
|
|
|
|
|
|
class AddressViewSet(viewsets.ModelViewSet):
|
|
schema_tags = ['Addresses']
|
|
serializer_class = AddressSerializer
|
|
permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
|
|
required_alternate_scopes = {
|
|
"GET": [[]],
|
|
"POST": [[]],
|
|
"PUT": [[]],
|
|
"PATCH": [[]],
|
|
"DELETE": [[]],
|
|
}
|
|
|
|
def get_queryset(self):
|
|
if getattr(self, 'swagger_fake_view', False):
|
|
return Address.objects.none()
|
|
return Address.objects.filter(user=self.request.user).select_related('city', 'neighborhood')
|