from rest_framework import viewsets

from apps.compliance.permissions import IsOpsOrAdmin

from .models import CAPARecord
from .serializers import CAPARecordSerializer


class CAPARecordViewSet(viewsets.ModelViewSet):
    queryset = CAPARecord.objects.all()
    serializer_class = CAPARecordSerializer
    # Corrective actions are an internal ops record — the buyer portal does not
    # read them at all, through the ORM or this API — so both read and write are
    # closed to a buyer.
    permission_classes = [IsOpsOrAdmin]