Mf%dZddlmZddlmZdZGddZGddeZGd d eZGd d Z Gd dZ GddZ Gddee Z Gdde ZGddeZGddeZGddeZGddeZGddeZGd d!eZGd"d#eZd$S)%z2 Provides a set of pluggable permission policies. )Http404) exceptions)GETHEADOPTIONSc,eZdZdZdZdZdZdZdS)OperationHolderMixinc.tt||SN OperandHolderANDselfothers YC:\Users\psant\Downloads\sloar back\myenv\Lib\site-packages\rest_framework/permissions.py__and__zOperationHolderMixin.__and__ sS$...c.tt||Sr r ORrs r__or__zOperationHolderMixin.__or__sRu---rc.tt||Sr r rs r__rand__zOperationHolderMixin.__rand__sS%...rc.tt||Sr rrs r__ror__zOperationHolderMixin.__ror__sR---rc,tt|Sr )SingleOperandHolderNOT)rs r __invert__zOperationHolderMixin.__invert__s"3---rN)__name__ __module__ __qualname__rrrrr rrr r s_///...///........rr ceZdZdZdZdS)rc"||_||_dSr )operator_class op1_class)rr'r(s r__init__zSingleOperandHolder.__init__s,"rcF|j|i|}||Sr )r(r')rargskwargsop1s r__call__zSingleOperandHolder.__call__!s,dnd-f--""3'''rN)r!r"r#r)r.r$rrrrs2###(((((rrc eZdZdZdZdZdS)r c0||_||_||_dSr )r'r( op2_class)rr'r(r1s rr)zOperandHolder.__init__'s,""rcb|j|i|}|j|i|}|||Sr )r(r1r')rr+r,r-op2s rr.zOperandHolder.__call__,sDdnd-f--dnd-f--""3,,,rct|to/|j|jko|j|jko|j|jkSr ) isinstancer r'r(r1rs r__eq__zOperandHolder.__eq__1sK um , , .  5#7 7 . Neo - . Neo -  rN)r!r"r#r)r.r6r$rrr r &sA### ---      rr c eZdZdZdZdZdS)rc"||_||_dSr r-r3rr-r3s rr)z AND.__init__;rcn|j||o|j||Sr r-has_permissionr3rrequestviews rr>zAND.has_permission?6 H # #GT 2 2 3 H # #GT 2 2 rcr|j|||o|j|||Sr )r-has_object_permissionr3rr@rAobjs rrDzAND.has_object_permissionEs: H * *7D# > > ? H * *7D# > > rNr!r"r#r)r>rDr$rrrr:sA        rrc eZdZdZdZdZdS)rc"||_||_dSr r9r:s rr)z OR.__init__Mr;rcn|j||p|j||Sr r=r?s rr>zOR.has_permissionQrBrc|j||o|j|||p6|j||o|j|||Sr )r-r>rDr3rEs rrDzOR.has_object_permissionWsr H # #GT 2 2 C..wcBB  H # #GT 2 2 C..wcBB  rNrGr$rrrrLsA        rrc eZdZdZdZdZdS)rc||_dSr )r-)rr-s rr)z NOT.__init__bs rc:|j|| Sr )r-r>r?s rr>zNOT.has_permissiones8**7D9999rc<|j||| Sr )r-rDrEs rrDzNOT.has_object_permissionhs811'4EEEErNrGr$rrrrasF:::FFFFFrrceZdZdS)BasePermissionMetaclassN)r!r"r#r$rrrQrQlsDrrQceZdZdZdZdZdS)BasePermissionzH A base class from which all permission classes should inherit. cdSzL Return `True` if permission is granted, `False` otherwise. Tr$r?s rr>zBasePermission.has_permissionu trcdSrUr$rEs rrDz$BasePermission.has_object_permission{rVrN)r!r"r#__doc__r>rDr$rrrSrSps< rrS) metaclassceZdZdZdZdS)AllowAnyz Allow any access. This isn't strictly required, since you could use an empty permission_classes list, but it's useful because it makes the intention more explicit. cdS)NTr$r?s rr>zAllowAny.has_permissionstrNr!r"r#rXr>r$rrr[r[s-rr[ceZdZdZdZdS)IsAuthenticatedz4 Allows access only to authenticated users. cBt|jo |jjSr )booluseris_authenticatedr?s rr>zIsAuthenticated.has_permissionsGLBW\%BCCCrNr]r$rrr_r_s2DDDDDrr_ceZdZdZdZdS) IsAdminUserz, Allows access only to admin users. cBt|jo |jjSr )rarbis_staffr?s rr>zIsAdminUser.has_permissionsGL:W\%:;;;rNr]r$rrreres-<<<<z(IsAuthenticatedOrReadOnly.has_permissions5 Nl * * L * L )   rNr]r$rrriris-     rricDeZdZdZgggdgdgdgdgdZdZdZdZd Zd S) DjangoModelPermissionsa} The request is authenticated using `django.contrib.auth` permissions. See: https://docs.djangoproject.com/en/dev/topics/auth/#permissions It ensures that the user is authenticated, and has the appropriate `add`/`change`/`delete` permissions on the model. This permission can only be applied against view classes that provide a `.queryset` attribute. %(app_label)s.add_%(model_name)s#%(app_label)s.change_%(model_name)s#%(app_label)s.delete_%(model_name)srrrPOSTPUTPATCHDELETETc|jj|jjd||jvrt j|fd|j|DS)z Given a model and an HTTP method, return the list of permission codes that the user is required to have.  app_label model_namecg|]}|zSr$r$.0permr,s r zCDjangoModelPermissions.get_required_permissions..AAA$v AAAr_metaryrz perms_maprMethodNotAllowedrrk model_clsr,s @rget_required_permissionsz/DjangoModelPermissions.get_required_permissionssb #2#/4    ' '-f55 5AAAA$.*@AAAArc>t|ds8t|dd'Jd|jjt|dr?|}|'Jd|jj|S|jS)N get_querysetquerysetz[Cannot apply {} on a view that does not set `.queryset` or have a `.get_queryset()` method.z{}.get_queryset() returned None)hasattrgetattrformat __class__r!rr)rrArs r _querysetz DjangoModelPermissions._querysetst^,, *tZ..:: > &( ) );:: 4 ( ( ((**H''1889PQQ(''O}rc|jr|jjs |jrdSt|ddrdS||}||j|j}|j|S)NF_ignore_model_permissionsT) rbrcauthenticated_users_onlyrrrrkmodel has_perms)rr@rArpermss rr>z%DjangoModelPermissions.has_permissions| |, 151N 5 44e < < 4>>$''--gnhnMM|%%e,,,rN) r!r"r#rXrrrrr>r$rrrnrns  34567889I $ B B B    - - - - -rrnceZdZdZdZdS)$DjangoModelPermissionsOrAnonReadOnlyzj Similar to DjangoModelPermissions, except that anonymous users are allowed read-only access. FN)r!r"r#rXrr$rrrrs" %rrc:eZdZdZgggdgdgdgdgdZdZdZdS) DjangoObjectPermissionsa The request is authenticated using Django's object-level permissions. It requires an object-permissions-enabled backend, such as Django Guardian. It ensures that the user is authenticated, and has the appropriate `add`/`change`/`delete` permissions on the object using .has_perms. This permission can only be applied against view classes that provide a `.queryset` attribute. rorprqrrc|jj|jjd||jvrt j|fd|j|DS)Nrxcg|]}|zSr$r$r|s rrzKDjangoObjectPermissions.get_required_object_permissions..rrrrs @rget_required_object_permissionsz7DjangoObjectPermissions.get_required_object_permissionss`"2#/4    ' '-f55 5AAAA$.*@AAAArcB||}|j}|j}||j|}|||sJ|jt vrt|d|}|||stdSdS)NrFT)rrrbrrkrrlr) rr@rArFrrrbr read_permss rrDz-DjangoObjectPermissions.has_object_permissions>>$''N |44W^YOO~~eS))  ~-- ==eYOOJ>>*c22  5trN)r!r"r#rXrrrDr$rrrrsn  34567889I B B BrrN)rX django.httprrest_frameworkrrlr rr rrrtyperQrSr[r_rerirnrrr$rrrs %%%%%%) ........"(((((.(((     (   (        $        *FFFFFFFF     2D   6$     ~   DDDDDnDDD<<<<<.<<<          F-F-F-F-F-^F-F-F-R%%%%%+A%%%99999499999r