Repository: openwisp/openwisp-controller (language: python)

Issue:
[change] REST API: implement view permissions
This is a follow up of #386 to add support for view permissions.

Depends on https://github.com/openwisp/openwisp-users/issues/249.


Discussion / hints:

Fix patch:
diff --git a/openwisp_controller/config/api/views.py b/openwisp_controller/config/api/views.py
index 055b1b2f9..232779d3c 100644
--- a/openwisp_controller/config/api/views.py
+++ b/openwisp_controller/config/api/views.py
@@ -5,11 +5,12 @@
     RetrieveAPIView,
     RetrieveUpdateDestroyAPIView,
 )
-from rest_framework.permissions import DjangoModelPermissions, IsAuthenticated
+from rest_framework.permissions import IsAuthenticated
 from swapper import load_model
 
 from openwisp_users.api.authentication import BearerAuthentication
 from openwisp_users.api.mixins import FilterByOrganizationManaged
+from openwisp_users.api.permissions import DjangoModelPermissions
 
 from ..admin import BaseConfigAdmin
 from .serializers import (


Test patch:
diff --git a/openwisp_controller/config/tests/test_api.py b/openwisp_controller/config/tests/test_api.py
index cc15f0aad..08a4a7725 100644
--- a/openwisp_controller/config/tests/test_api.py
+++ b/openwisp_controller/config/tests/test_api.py
@@ -1,3 +1,4 @@
+from django.contrib.auth.models import Permission
 from django.core.exceptions import ValidationError
 from django.test import TestCase
 from django.urls import reverse
@@ -11,6 +12,7 @@
 Template = load_model('config', 'Template')
 Vpn = load_model('config', 'Vpn')
 Device = load_model('config', 'Device')
+OrganizationUser = load_model('openwisp_users', 'OrganizationUser')
 
 
 class TestConfigApi(
@@ -510,3 +512,44 @@ def test_vpn_delete_api(self):
         r = self.client.delete(path)
         self.assertEqual(r.status_code, 204)
         self.assertEqual(Vpn.objects.count(), 0)
+
+    def test_get_request_with_change_perm(self):
+        change_perm = Permission.objects.filter(codename='change_template')
+        user = self._get_user()
+        user.user_permissions.add(*change_perm)
+        org1 = self._get_org()
+        OrganizationUser.objects.create(user=user, organization=org1, is_admin=True)
+        self.client.force_login(user)
+        t1 = self._create_template(name='t1', organization=self._get_org())
+        with self.subTest('Get Template List'):
+            path = reverse('config_api:template_list')
+            response = self.client.get(path)
+            self.assertEqual(response.status_code, 200)
+        with self.subTest('Get Template Detail'):
+            path = reverse('config_api:template_detail', args=[t1.pk])
+            response = self.client.get(path)
+            self.assertEqual(response.status_code, 200)
+
+    def test_get_request_with_view_perm(self):
+        view_perm = Permission.objects.filter(codename='view_template')
+        user = self._get_user()
+        user.user_permissions.add(*view_perm)
+        org1 = self._get_org()
+        OrganizationUser.objects.create(user=user, organization=org1, is_admin=True)
+        self.client.force_login(user)
+        t1 = self._create_template(name='t1', organization=self._get_org())
+        with self.subTest('Get Template List'):
+            path = reverse('config_api:template_list')
+            response = self.client.get(path)
+            self.assertEqual(response.status_code, 200)
+        with self.subTest('Get Template Detail'):
+            path = reverse('config_api:template_detail', args=[t1.pk])
+            response = self.client.get(path)
+            self.assertEqual(response.status_code, 200)
+
+    def test_get_request_with_no_perm(self):
+        user = self._get_user()
+        self.client.force_login(user)
+        path = reverse('config_api:template_list')
+        response = self.client.get(path)
+        self.assertEqual(response.status_code, 403)