leanderandClaude Opus 5.5
7ab2a0f1f2
The inventory page gets a "Ny vare" link and a "Rediger" link per product, leading to a form for name, prices, volume, alcohol, description and whether the product is for sale. Stock still changes only through inventory transactions and sales, and the image through the admin. Saving needs the same access as the Django admin: staff, plus the add or change product permission (superusers have both). The server checks this on every save and validates with the model's rules. Logged out visitors are sent to log in and back to the form. New in the API: createProduct and updateProduct mutations, a product query, and a me query so the frontend knows who is logged in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
15 lines
461 B
Python
15 lines
461 B
Python
"""Who may do what through the API, using the same rules as the Django admin."""
|
|
|
|
|
|
def _admin_can(user, permission):
|
|
# The admin only lets in staff, and then checks the model permission (superusers have all of them)
|
|
return user.is_authenticated and user.is_staff and user.has_perm(permission)
|
|
|
|
|
|
def can_add_products(user):
|
|
return _admin_can(user, "bbs.add_product")
|
|
|
|
|
|
def can_change_products(user):
|
|
return _admin_can(user, "bbs.change_product")
|