Split PublicDetailPrivateListing permission class
Move out the logic that authorize a user hitting /projects/ and create
a different class for this (it's used in corporate as well).
Leave the PublicDetailPrivateListing class only with the needed logic
for this goal: detail access is public and listing access is private.
from rest_framework.permissions import IsAuthenticated, BasePermission
+from readthedocs.core.utils.extend import SettingsOverrideObject
+
+
+class UserProjectsListing(BasePermission):
+ def has_permission(self, request, view):
+ if view.basename == 'projects' and any([
+ view.action == 'list',
+ view.action == 'create', # used to create Form in BrowsableAPIRenderer
+ view.action is None, # needed for BrowsableAPIRenderer
+ ]):
+ # hitting ``/projects/``, allowing
+ return True
+
class PublicDetailPrivateListing(IsAuthenticated):
@@ -12,16 +25,6 @@ class PublicDetailPrivateListing(IsAuthenticated):
"""
def has_permission(self, request, view):
- is_authenticated = super().has_permission(request, view)
- if is_authenticated:
- if view.basename == 'projects' and any([
- view.action == 'list',
- view.action == 'create', # used to create Form in BrowsableAPIRenderer
- view.action is None, # needed for BrowsableAPIRenderer
- ]):
- # hitting ``/projects/``, allowing
- return True
-
# NOTE: ``superproject`` is an action name, defined by the class
# method under ``ProjectViewSet``. We should apply the same
# permissions restrictions than for a detail action (since it only
