|
6 | 6 | from django.conf import settings
|
7 | 7 | from django.contrib import messages
|
8 | 8 | from django.contrib.auth import authenticate, get_user_model, login, logout
|
| 9 | +from django.contrib.auth.decorators import login_required |
9 | 10 | from django.core.exceptions import ObjectDoesNotExist
|
10 | 11 | from django.forms import ValidationError
|
11 | 12 | from django.http import HttpResponseBadRequest, JsonResponse
|
|
15 | 16 | from django.views.decorators.debug import sensitive_variables
|
16 | 17 | from requests_oauthlib import OAuth2Session
|
17 | 18 | from rest_framework import permissions, viewsets
|
| 19 | +from rest_framework.decorators import action |
18 | 20 |
|
19 | 21 | from django_airavata.apps.auth import serializers
|
20 | 22 |
|
@@ -507,25 +509,37 @@ def _create_login_desktop_failed_response(request, idp_alias=None):
|
507 | 509 | "?" + urlencode(params))
|
508 | 510 |
|
509 | 511 |
|
510 |
| -class IsUserOrReadOnlyForSuperuser(permissions.BasePermission): |
| 512 | +@login_required |
| 513 | +def user_profile(request): |
| 514 | + return render(request, "django_airavata_auth/base.html", { |
| 515 | + 'bundle_name': "user-profile" |
| 516 | + }) |
| 517 | + |
| 518 | + |
| 519 | +class IsUserOrReadOnlyForAdmins(permissions.BasePermission): |
511 | 520 | def has_permission(self, request, view):
|
512 | 521 | return request.user.is_authenticated
|
513 | 522 |
|
514 | 523 | def has_object_permission(self, request, view, obj):
|
515 | 524 | if (request.method in permissions.SAFE_METHODS and
|
516 |
| - request.user.is_superuser): |
| 525 | + request.is_gateway_admin): |
517 | 526 | return True
|
518 | 527 | return obj == request.user
|
519 | 528 |
|
520 | 529 |
|
| 530 | +# TODO: disable deleting and creating? |
521 | 531 | class UserViewSet(viewsets.ModelViewSet):
|
522 | 532 | serializer_class = serializers.UserSerializer
|
523 | 533 | queryset = get_user_model().objects.all()
|
524 |
| - permission_classes = [IsUserOrReadOnlyForSuperuser] |
| 534 | + permission_classes = [IsUserOrReadOnlyForAdmins] |
525 | 535 |
|
526 | 536 | def get_queryset(self):
|
527 | 537 | user = self.request.user
|
528 | 538 | if user.is_superuser:
|
529 | 539 | return get_user_model().objects.all()
|
530 | 540 | else:
|
531 | 541 | return get_user_model().objects.get(pk=user.pk)
|
| 542 | + |
| 543 | + @action(detail=False) |
| 544 | + def current(self, request): |
| 545 | + return redirect(reverse('django_airavata_auth:user-detail', kwargs={'pk': request.user.id})) |
0 commit comments