diff --git a/api/v1/permissions.py b/api/v1/permissions.py index b7f6e693..9af001d6 100644 --- a/api/v1/permissions.py +++ b/api/v1/permissions.py @@ -12,6 +12,15 @@ class IsAdmin(BasePermission): ) +class IsTeacherOrAdmin(BasePermission): + def has_permission(self, request, view): + return request.user.is_authenticated and ( + request.user.role in [ + User.TEACHER_ROLE, User.ADMIN_ROLE + ] or request.user.is_staff or request.user.is_superuser + ) + + class IsAdminOrIsSelf(BasePermission): def has_object_permission(self, request, view, user): return request.user.is_authenticated and ( diff --git a/api/v1/serializers/school.py b/api/v1/serializers/school.py index d50ade9c..a051c494 100644 --- a/api/v1/serializers/school.py +++ b/api/v1/serializers/school.py @@ -10,6 +10,7 @@ from .content import ( ) from .mixins import DispatchContentMixin + class GalleryImageCreateSerializer(serializers.ModelSerializer): class Meta: diff --git a/api/v1/views.py b/api/v1/views.py index 407668a1..ca57e9cf 100644 --- a/api/v1/views.py +++ b/api/v1/views.py @@ -35,7 +35,11 @@ from .serializers.user import ( UserSerializer, UserPhotoSerializer, ) -from .permissions import IsAdmin, IsAdminOrIsSelf, IsAuthorOrAdmin, IsAuthorObjectOrAdmin +from .permissions import ( + IsAdmin, IsAdminOrIsSelf, + IsAuthorOrAdmin, IsAuthorObjectOrAdmin, + IsTeacherOrAdmin, +) from apps.course.models import ( Category, Course, @@ -340,7 +344,7 @@ class UserViewSet(ExtendedModelViewSet): class SchoolScheduleViewSet(ExtendedModelViewSet): queryset = SchoolSchedule.objects.all() serializer_class = SchoolScheduleSerializer - permission_classes = (IsAdmin,) + permission_classes = (IsTeacherOrAdmin,) class ConfigViewSet(generics.RetrieveUpdateAPIView):