Merge pull request #63 from PROCOLLAB-github/dev

Dev

Author: yakser

projects/permissions.py

@@ -1,7 +1,7 @@
 from rest_framework.permissions import BasePermission, SAFE_METHODS
 
 
-class IsProjectLeaderOrReadOnly(BasePermission):
+class IsProjectLeaderOrReadOnlyForNonDrafts(BasePermission):
     """
     Allows access to update only to project leader.
     """
@@ -12,6 +12,8 @@ def has_permission(self, request, view) -> bool:
         return False
 
     def has_object_permission(self, request, view, obj):
-        if request.method in SAFE_METHODS or (obj.leader == request.user):
+        if (request.method in SAFE_METHODS and not obj.draft) or (
+            obj.leader == request.user
+        ):
             return True
         return False

projects/serializers.py

@@ -64,6 +64,7 @@ class ProjectDetailSerializer(serializers.ModelSerializer):
     )
     vacancies = ProjectVacancyListSerializer(many=True, read_only=True)
     short_description = serializers.SerializerMethodField()
+    industry_id = serializers.IntegerField(write_only=True, required=False)
 
     def validate(self, data):
         super().validate(data)
@@ -97,6 +98,7 @@ class Meta:
             "vacancies",
             "datetime_created",
             "datetime_updated",
+            "industry_id",
         ]
         read_only_fields = ["leader"]
 

projects/views.py

@@ -7,7 +7,7 @@
 from projects.filters import ProjectFilter
 from projects.helpers import VERBOSE_STEPS
 from projects.models import Project, Achievement
-from projects.permissions import IsProjectLeaderOrReadOnly
+from projects.permissions import IsProjectLeaderOrReadOnlyForNonDrafts
 from projects.serializers import (
     ProjectDetailSerializer,
     AchievementListSerializer,
@@ -71,7 +71,7 @@ def post(self, request, *args, **kwargs):
 class ProjectDetail(generics.RetrieveUpdateDestroyAPIView):
     queryset = Project.objects.get_projects_for_detail_view()
     serializer_class = ProjectDetailSerializer
-    permission_classes = [IsProjectLeaderOrReadOnly]
+    permission_classes = [IsProjectLeaderOrReadOnlyForNonDrafts]
 
     def put(self, request, pk, **kwargs):
         # bootleg version of updating achievements via project
@@ -120,7 +120,7 @@ class ProjectCollaborators(generics.GenericAPIView):
     Project collaborator retrieve/add/delete view
     """
 
-    permission_classes = [IsProjectLeaderOrReadOnly]
+    permission_classes = [IsProjectLeaderOrReadOnlyForNonDrafts]
     queryset = Project.objects.all()
     serializer_class = ProjectCollaboratorSerializer
 

users/serializers.py

@@ -74,6 +74,7 @@ class Meta:
             "key_skills",
             "birthday",
             "speciality",
+            "organization",
             "about_me",
             "avatar",
             "city",

vacancy/permissions.py

@@ -8,6 +8,17 @@ def has_object_permission(self, request, view, obj):
         return False
 
 
+class IsVacancyProjectLeader(BasePermission):
+    """
+    Allows access to vacancy update only to project leader.
+    """
+
+    def has_object_permission(self, request, view, obj):
+        if request.method in SAFE_METHODS or obj.project.leader == request.user:
+            return True
+        return False
+
+
 class IsProjectLeaderForVacancyResponse(BasePermission):
     def has_object_permission(self, request, view, obj):
         if obj.vacancy.project.leader == request.user:

vacancy/views.py

@@ -3,12 +3,12 @@
 from rest_framework.generics import GenericAPIView
 from rest_framework.response import Response
 
-from projects.permissions import IsProjectLeaderOrReadOnly
 from vacancy.filters import VacancyFilter
 from vacancy.models import Vacancy, VacancyResponse
 from vacancy.permissions import (
     IsProjectLeaderForVacancyResponse,
     IsVacancyResponseOwnerOrReadOnly,
+    IsVacancyProjectLeader,
 )
 from vacancy.serializers import (
     ProjectVacancyListSerializer,
@@ -40,7 +40,7 @@ def create(self, request, *args, **kwargs):
 class VacancyDetail(generics.RetrieveUpdateDestroyAPIView):
     queryset = Vacancy.objects.get_vacancy_for_detail_view()
     serializer_class = VacancyDetailSerializer
-    permission_classes = [IsProjectLeaderOrReadOnly]
+    permission_classes = [IsVacancyProjectLeader]
 
     def put(self, request, *args, **kwargs):
         """updating the vacancy"""