crashreports/permissions.py

from crashreports.models import Device
from rest_framework.permissions import BasePermission


def user_owns_uuid(user, uuid):
    try:
        device = Device.objects.get(user=user)
    except:
        return False
    if (uuid == device.uuid):
        return True
    return False


def user_is_hiccup_staff(user):
    if (user.groups.filter(name='FairphoneSoftwareTeam').exists()):
        return True
    else:
        return user.has_perms([
            # Crashreports
            'crashreports.add_crashreport', 'crashreports.change_crashreport',
            'crashreports.del_crashreport',
            # Heartbeats
            'heartbeat.add_crashreport', 'heartbeat.change_crashreport',
            'heartbeat.del_crashreport',
            # Logfiles
            'heartbeat.add_logfile', 'heartbeat.change_logfile',
            'heartbeat.del_logfile',
            ])

class HasStatsAccess(BasePermission):
    def has_permission(self, request, view):
        return user_is_hiccup_staff(request.user)

class HasRightsOrIsDeviceOwnerDeviceCreation(BasePermission):
    def has_permission(self, request, view):
        if (user_is_hiccup_staff(request.user)):
            return True

        # special case:
        # user is the owner of a device. in this case creations are allowed.
        # we have to check if the device with the supplied uuid indeed
        # belongs to the user
        if request.method == 'POST':
            if ('uuid' not in request.data):
                return False
            return user_owns_uuid(request.user, request.data["uuid"])
        return False