Implement permission checking in views and forms

core/views/__init__.py

@@ -1,5 +1,8 @@
 import uuid
 
+from django.core.exceptions import ImproperlyConfigured
+from django.core.paginator import Paginator
+from django.db.models import QuerySet
 from django.http import Http404, HttpResponseBadRequest
 from django.urls import reverse
 from django.views.generic.detail import DetailView
@@ -12,6 +15,59 @@ from core.util import logs
 log = logs.get_logger(__name__)
 
 
+class RestrictedViewMixin:
+    """
+    This mixin overrides two helpers in order to pass the user object to the filters.
+    get_queryset alters the objects returned for list views.
+    get_form_kwargs passes the request object to the form class. Remaining permissions
+    checks are in forms.py
+    """
+
+    allow_empty = True
+    queryset = None
+    model = None
+    paginate_by = None
+    paginate_orphans = 0
+    context_object_name = None
+    paginator_class = Paginator
+    page_kwarg = "page"
+    ordering = None
+
+    def get_queryset(self):
+        """
+        This function is overriden to filter the objects by the requesting user.
+        """
+        if self.queryset is not None:
+            queryset = self.queryset
+            if isinstance(queryset, QuerySet):
+                # queryset = queryset.all()
+                queryset = queryset.filter(user=self.request.user)
+        elif self.model is not None:
+            queryset = self.model._default_manager.filter(user=self.request.user)
+        else:
+            raise ImproperlyConfigured(
+                "%(cls)s is missing a QuerySet. Define "
+                "%(cls)s.model, %(cls)s.queryset, or override "
+                "%(cls)s.get_queryset()." % {"cls": self.__class__.__name__}
+            )
+        if hasattr(self, "get_ordering"):
+            ordering = self.get_ordering()
+            if ordering:
+                if isinstance(ordering, str):
+                    ordering = (ordering,)
+                queryset = queryset.order_by(*ordering)
+
+        return queryset
+
+    def get_form_kwargs(self):
+        """Passes the request object to the form class.
+        This is necessary to only display members that belong to a given user"""
+
+        kwargs = super().get_form_kwargs()
+        kwargs["request"] = self.request
+        return kwargs
+
+
 class ObjectNameMixin(object):
     def __init__(self, *args, **kwargs):
         self.title_singular = self.model._meta.verbose_name.title()  # Hook
@@ -26,7 +82,7 @@ class ObjectNameMixin(object):
         super().__init__(*args, **kwargs)
 
 
-class ObjectList(ObjectNameMixin, ListView):
+class ObjectList(RestrictedViewMixin, ObjectNameMixin, ListView):
     allowed_types = ["modal", "widget", "window", "page"]
     window_content = "window-content/objects.html"
     list_template = None
@@ -44,6 +100,7 @@ class ObjectList(ObjectNameMixin, ListView):
 
     # copied from BaseListView
     def get(self, request, *args, **kwargs):
+        self.request = request
         self.object_list = self.get_queryset()
         allow_empty = self.get_allow_empty()
 
@@ -103,7 +160,7 @@ class ObjectList(ObjectNameMixin, ListView):
         return self.render_to_response(context)
 
 
-class ObjectCreate(ObjectNameMixin, CreateView):
+class ObjectCreate(RestrictedViewMixin, ObjectNameMixin, CreateView):
     allowed_types = ["modal", "widget", "window", "page"]
     window_content = "window-content/object-form.html"
     parser_classes = [FormParser]
@@ -178,14 +235,14 @@ class ObjectCreate(ObjectNameMixin, CreateView):
         return super().post(request, *args, **kwargs)
 
 
-class ObjectRead(ObjectNameMixin, DetailView):
+class ObjectRead(RestrictedViewMixin, ObjectNameMixin, DetailView):
     allowed_types = ["modal", "widget", "window", "page"]
     window_content = "window-content/object.html"
 
     model = None
 
 
-class ObjectUpdate(ObjectNameMixin, UpdateView):
+class ObjectUpdate(RestrictedViewMixin, ObjectNameMixin, UpdateView):
     allowed_types = ["modal", "widget", "window", "page"]
     window_content = "window-content/object-form.html"
     parser_classes = [FormParser]
@@ -249,7 +306,7 @@ class ObjectUpdate(ObjectNameMixin, UpdateView):
         return super().post(request, *args, **kwargs)
 
 
-class ObjectDelete(ObjectNameMixin, DeleteView):
+class ObjectDelete(RestrictedViewMixin, ObjectNameMixin, DeleteView):
     model = None
     template_name = "partials/notify.html"