From a0cb16e5c40a8473ea0c22bd990a347eef4edcbe Mon Sep 17 00:00:00 2001 From: Bai Date: Mon, 18 Jan 2021 18:03:40 +0800 Subject: [PATCH] =?UTF-8?q?perf:=20=E4=BF=AE=E6=94=B9=E5=85=B3=E9=97=AD?= =?UTF-8?q?=E5=B7=A5=E5=8D=95API=E6=9D=83=E9=99=90,=20=E7=94=B3=E8=AF=B7?= =?UTF-8?q?=E4=BA=BA=E6=9C=89=E6=9D=83=E9=99=90=E5=85=B3=E9=97=AD=E5=B7=A5?= =?UTF-8?q?=E5=8D=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- apps/tickets/api/ticket.py | 4 ++-- apps/tickets/permissions/ticket.py | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/apps/tickets/api/ticket.py b/apps/tickets/api/ticket.py index 79d49b37d..07b6ec89e 100644 --- a/apps/tickets/api/ticket.py +++ b/apps/tickets/api/ticket.py @@ -12,7 +12,7 @@ from common.permissions import IsValidUser, IsOrgAdmin from tickets import serializers from tickets.models import Ticket -from tickets.permissions.ticket import IsAssignee, NotClosed +from tickets.permissions.ticket import IsAssignee, IsAssigneeOrApplicant, NotClosed __all__ = ['TicketViewSet'] @@ -68,7 +68,7 @@ class TicketViewSet(CommonApiMixin, viewsets.ModelViewSet): instance.reject(processor=request.user) return Response(serializer.data) - @action(detail=True, methods=[PUT], permission_classes=[IsOrgAdmin, IsAssignee, NotClosed]) + @action(detail=True, methods=[PUT], permission_classes=[IsAssigneeOrApplicant, NotClosed]) def close(self, request, *args, **kwargs): instance = self.get_object() serializer = self.get_serializer(instance) diff --git a/apps/tickets/permissions/ticket.py b/apps/tickets/permissions/ticket.py index c16db9fe6..dbc74e6a9 100644 --- a/apps/tickets/permissions/ticket.py +++ b/apps/tickets/permissions/ticket.py @@ -7,6 +7,12 @@ class IsAssignee(permissions.BasePermission): return obj.has_assignee(request.user) +class IsAssigneeOrApplicant(IsAssignee): + + def has_object_permission(self, request, view, obj): + return super().has_object_permission(request, view, obj) or obj.applicant == request.user + + class NotClosed(permissions.BasePermission): def has_object_permission(self, request, view, obj): return not obj.status_closed