94 lines
3.2 KiB
Python
94 lines
3.2 KiB
Python
"""
|
|
Complaints permissions - Control who can create and manage complaints/inquiries
|
|
"""
|
|
from rest_framework import permissions
|
|
|
|
|
|
class CanCreateComplaint(permissions.BasePermission):
|
|
"""
|
|
Permission to check if user can create complaints.
|
|
|
|
Source Users need explicit permission.
|
|
Patients can create their own complaints.
|
|
PX Admins and Hospital Admins can create.
|
|
"""
|
|
def has_permission(self, request, view):
|
|
if not request.user or not request.user.is_authenticated:
|
|
return False
|
|
|
|
# PX Admins can create
|
|
if request.user.is_px_admin():
|
|
return True
|
|
|
|
# Hospital Admins can create
|
|
if request.user.is_hospital_admin():
|
|
return True
|
|
|
|
# Source Users need explicit permission
|
|
if hasattr(request.user, 'source_user_profile'):
|
|
source_user = request.user.source_user_profile.first()
|
|
if source_user and source_user.is_active and source_user.can_create_complaints:
|
|
return True
|
|
return False
|
|
|
|
# Patients can create (assuming they have user accounts)
|
|
# For public forms without auth, use IsAuthenticatedOrReadOnly
|
|
return True
|
|
|
|
|
|
class CanCreateInquiry(permissions.BasePermission):
|
|
"""
|
|
Permission to check if user can create inquiries.
|
|
|
|
Source Users need explicit permission.
|
|
Patients can create their own inquiries.
|
|
PX Admins and Hospital Admins can create.
|
|
"""
|
|
def has_permission(self, request, view):
|
|
if not request.user or not request.user.is_authenticated:
|
|
return False
|
|
|
|
# PX Admins can create
|
|
if request.user.is_px_admin():
|
|
return True
|
|
|
|
# Hospital Admins can create
|
|
if request.user.is_hospital_admin():
|
|
return True
|
|
|
|
# Source Users need explicit permission
|
|
if hasattr(request.user, 'source_user_profile'):
|
|
source_user = request.user.source_user_profile.first()
|
|
if source_user and source_user.is_active and source_user.can_create_inquiries:
|
|
return True
|
|
return False
|
|
|
|
# Patients can create (assuming they have user accounts)
|
|
return True
|
|
|
|
|
|
class CanAccessOwnData(permissions.BasePermission):
|
|
"""
|
|
Permission to check if user can access their own data.
|
|
|
|
Source Users can only access complaints/inquiries they created.
|
|
Patients can only access their own complaints/inquiries.
|
|
PX Admins can access all data.
|
|
"""
|
|
def has_object_permission(self, request, view, obj):
|
|
# PX Admins can access everything
|
|
if request.user.is_px_admin():
|
|
return True
|
|
|
|
# Source Users can only access their own created data
|
|
if hasattr(request.user, 'source_user_profile'):
|
|
if request.user.source_user_profile.exists():
|
|
return getattr(obj, 'created_by', None) == request.user
|
|
|
|
# Patients can only access their own data
|
|
if hasattr(obj, 'patient'):
|
|
if hasattr(obj.patient, 'user'):
|
|
return obj.patient.user == request.user
|
|
|
|
# Default: deny
|
|
return False |