o Fh%@sdZddlmZddlmZdZGdddZGdddeZGd d d eZGd d d Z Gd ddZ GdddZ Gdddee Z Gddde dZGdddeZGdddeZGdddeZGdddeZGdddeZGd d!d!eZGd"d#d#eZd$S)%z2 Provides a set of pluggable permission policies. )Http404) exceptions)GETHEADOPTIONSc@s4eZdZddZddZddZddZd d Zd S) OperationHolderMixincC tt||SN OperandHolderANDselfotherrS/var/www/html/loop/nvenv/lib/python3.10/site-packages/rest_framework/permissions.py__and__  zOperationHolderMixin.__and__cCrr r ORr rrr__or__rzOperationHolderMixin.__or__cC tt||Sr r r rrr__rand__rzOperationHolderMixin.__rand__cCrr rr rrr__ror__rzOperationHolderMixin.__ror__cCs tt|Sr )SingleOperandHolderNOT)rrrr __invert__ zOperationHolderMixin.__invert__N)__name__ __module__ __qualname__rrrrrrrrrr s  rc@seZdZddZddZdS)rcC||_||_dSr )operator_class op1_class)rr"r#rrr__init__ zSingleOperandHolder.__init__cOs|j|i|}||Sr )r#r")rargskwargsop1rrr__call__!s zSingleOperandHolder.__call__N)rrr r$r)rrrrrs rc@$eZdZddZddZddZdS)r cCs||_||_||_dSr )r"r# op2_class)rr"r#r+rrrr$'s zOperandHolder.__init__cOs,|j|i|}|j|i|}|||Sr )r#r+r")rr&r'r(op2rrrr),s zOperandHolder.__call__cCs.t|to|j|jko|j|jko|j|jkSr ) isinstancer r"r#r+r rrr__eq__1s    zOperandHolder.__eq__N)rrr r$r)r.rrrrr &s r c@r*)r cCr!r r(r,rr(r,rrrr$;r%z AND.__init__cCs|j||o |j||Sr r(has_permissionr,rrequestviewrrrr2? zAND.has_permissioncCs |j|||o|j|||Sr )r(has_object_permissionr,rr4r5objrrrr7EszAND.has_object_permissionNrrr r$r2r7rrrrr : r c@r*)rcCr!r r/r0rrrr$Mr%z OR.__init__cCs|j||p |j||Sr r1r3rrrr2Qr6zOR.has_permissioncCs<|j||o|j|||p|j||o|j|||Sr )r(r2r7r,r8rrrr7Ws zOR.has_object_permissionNr:rrrrrLr;rc@r*)rcCs ||_dSr )r()rr(rrrr$brz NOT.__init__cCs|j|| Sr )r(r2r3rrrr2eszNOT.has_permissioncCs|j||| Sr )r(r7r8rrrr7hzNOT.has_object_permissionNr:rrrrras rc@s eZdZdS)BasePermissionMetaclassN)rrr rrrrr=lsr=c@s eZdZdZddZddZdS)BasePermissionzH A base class from which all permission classes should inherit. cCdSzL Return `True` if permission is granted, `False` otherwise. Trr3rrrr2uzBasePermission.has_permissioncCr?r@rr8rrrr7{rAz$BasePermission.has_object_permissionN)rrr __doc__r2r7rrrrr>ps r>) metaclassc@eZdZdZddZdS)AllowAnyz Allow any access. This isn't strictly required, since you could use an empty permission_classes list, but it's useful because it makes the intention more explicit. cCr?)NTrr3rrrr2szAllowAny.has_permissionNrrr rBr2rrrrrEs rEc@rD)IsAuthenticatedz4 Allows access only to authenticated users. cCt|jo|jjSr )booluseris_authenticatedr3rrrr2r<zIsAuthenticated.has_permissionNrFrrrrrG rGc@rD) IsAdminUserz, Allows access only to admin users. cCrHr )rIrJis_staffr3rrrr2r<zIsAdminUser.has_permissionNrFrrrrrMrLrMc@rD)IsAuthenticatedOrReadOnlyzL The request is authenticated as a user, or is a read-only request. cCst|jtvp |jo |jjSr )rImethod SAFE_METHODSrJrKr3rrrr2s  z(IsAuthenticatedOrReadOnly.has_permissionNrFrrrrrOrLrOc@sHeZdZdZgggdgdgdgdgdZdZddZd d Zd d Zd S)DjangoModelPermissionsa} The request is authenticated using `django.contrib.auth` permissions. See: https://docs.djangoproject.com/en/dev/topics/auth/#permissions It ensures that the user is authenticated, and has the appropriate `add`/`change`/`delete` permissions on the model. This permission can only be applied against view classes that provide a `.queryset` attribute. %(app_label)s.add_%(model_name)s#%(app_label)s.change_%(model_name)s#%(app_label)s.delete_%(model_name)srrrPOSTPUTPATCHDELETETc>|jj|jjd||jvrt|fdd|j|DS)z Given a model and an HTTP method, return the list of permission codes that the user is required to have.  app_label model_namecg|]}|qSrr.0permr'rr zCDjangoModelPermissions.get_required_permissions.._metar]r^ perms_maprMethodNotAllowedrrP model_clsrrcrget_required_permissionss   z/DjangoModelPermissions.get_required_permissionscCsbt|dst|dddusJd|jjt|dr.|}|dus,Jd|jj|S|jS)N get_querysetquerysetz[Cannot apply {} on a view that does not set `.queryset` or have a `.get_queryset()` method.z{}.get_queryset() returned None)hasattrgetattrformat __class__rrmrn)rr5rnrrr _querysets     z DjangoModelPermissions._querysetcCsN|jr |jjs |jr dSt|ddrdS||}||j|j}|j|S)NF_ignore_model_permissionsT) rJrKauthenticated_users_onlyrprsrlrPmodel has_perms)rr4r5rnpermsrrrr2s   z%DjangoModelPermissions.has_permissionN) rrr rBrhrurlrsr2rrrrrRs  rRc@seZdZdZdZdS)$DjangoModelPermissionsOrAnonReadOnlyzj Similar to DjangoModelPermissions, except that anonymous users are allowed read-only access. FN)rrr rBrurrrrrysryc@s<eZdZdZgggdgdgdgdgdZddZdd Zd S) DjangoObjectPermissionsa The request is authenticated using Django's object-level permissions. It requires an object-permissions-enabled backend, such as Django Guardian. It ensures that the user is authenticated, and has the appropriate `add`/`change`/`delete` permissions on the object using .has_perms. This permission can only be applied against view classes that provide a `.queryset` attribute. rSrTrUrVcr[)Nr\cr_rrr`rcrrrdrezKDjangoObjectPermissions.get_required_object_permissions..rfrjrrcrget_required_object_permissionss   z7DjangoObjectPermissions.get_required_object_permissionsc Csb||}|j}|j}||j|}|||s/|jtvrt|d|}|||s-tdSdS)NrFT)rsrvrJr{rPrwrQr) rr4r5r9rnrkrJrx read_permsrrrr7s     z-DjangoObjectPermissions.has_object_permissionN)rrr rBrhr{r7rrrrrzs  rzN)rB django.httprrest_frameworkrrQrrr r rrtyper=r>rErGrMrOrRryrzrrrrs&        I