New user groups without editing permissions #1079
Comments
szabozoltan69
changed the title
|
In Staging Admin I created an "IFRC Public" group with these "view" permissions. If too broad, let me know. |
|
We need to adjust the frontend as well to the view only permissions. E.g. this users shouldn't be able to create FR or 3W project either. @udaynwa , could you please look into this with the team? |
Behavioral Document for Guest Permission in IFRC-GOFlow of eventsGo platform will have a new type of user called Technical Flow
from rest_framework import permissions
class DenyGuestUserMutationPermission(permissions.BasePermission):
"""
Custom permission to deny mutation actions for logged-in guest users.
This permission class allows all safe (read-only) operations but restricts
any mutation (write, update, delete) operations if the user is a guest.
"""
def _has_permission(self, request, view):
# Allow all safe methods (GET, HEAD, OPTIONS) which are non-mutating.
if request.method in permissions.SAFE_METHODS:
return True
# For mutation methods (POST, PUT, DELETE, etc.):
# Check if the user is authenticated.
if not bool(request.user and request.user.is_authenticated):
# Deny access if the user is not authenticated.
return False
# Deny access if the authenticated user is marked as a guest.
return not request.user.limit_access_to_guest
def has_permission(self, request, view):
return self._has_permission(request, view)
def has_object_permission(self, request, view, obj):
return self._has_permission(request, view)Custom Specifically, it allows all safe (read-only) operations like GET, HEAD, and OPTIONS for any user. However, for mutation actions such as POST, PUT, and DELETE, it enforces the following rules:
|
2 tasks
|
xref IFRCGo/go-api#1568 |
samshara
added
type: epic
|
@arunissun made some tests and reported the following issues:
Also, this work affected the public view (not logged-in users): |
@tovari @arunissun is this about changing the user's language preference from the top right corner? If so, I believe this is working on staging. |
Please check it again. It doesn't work for us:
|
This was referenced Sep 4, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
We need a new user group for those users who want a GO account, but not part of RC Movement. They can be:
The users shouldn't have any editing rights (no permissions to create any type of content either (e.g. FR, 3W project))
They should have access to view only Public content.
The should be able to subscribe for notifications. They should be able to generate Monty API tokens.
Similarly unverified NS users (without whitelisted email domain) will have the same abilities.
Frontend Tasks
Backend Tasks
The text was updated successfully, but these errors were encountered: