ixgadmin
8ad83a7a65
Batch writes were closed in 88eede5, but every other app's viewset still used
IsAuthenticated, which in this platform means any buyer. A buyer could rewrite a
document record, create a QC result (which moves the batch status and raises a
CAPA), and reach the write endpoints for CAPAs, certificates, ESG reports and
shipments.
- Use the one IsOpsOrAdmin from apps.compliance.permissions; drop the duplicate
copy in apps/qc/views.py.
- Apply it to the whole viewset on shipments, qc, capa, esg, documents,
certificates-of-analysis and regulatory-certs. The buyer portal is
server-rendered through the ORM, so it needs none of these APIs.
- Keep the buyer chat working: AI interactions stay authenticated and scoped,
and agent reads stay open while agent writes become ops/admin.
- Close a buyer-to-admin escalation in the users API: writes are admin-only and
role/is_active are read-only, so a buyer can no longer PATCH their own row to
role=admin and then pass every IsOpsOrAdmin check.
16 lines
596 B
Python
16 lines
596 B
Python
from rest_framework import viewsets
|
|
|
|
from apps.compliance.permissions import IsOpsOrAdmin
|
|
|
|
from .models import Shipment
|
|
from .serializers import ShipmentSerializer
|
|
|
|
|
|
class ShipmentViewSet(viewsets.ModelViewSet):
|
|
queryset = Shipment.objects.all()
|
|
serializer_class = ShipmentSerializer
|
|
# The buyer portal reads shipments through the ORM (apps/buyer/views.py), not
|
|
# this API, so nothing outside ops/admin needs it — including for reads. A
|
|
# buyer must not be able to create a shipment or rewrite the status its own
|
|
# page displays.
|
|
permission_classes = [IsOpsOrAdmin]
|