ixgadmin
8ad83a7a65
Batch writes were closed in 88eede5, but every other app's viewset still used
IsAuthenticated, which in this platform means any buyer. A buyer could rewrite a
document record, create a QC result (which moves the batch status and raises a
CAPA), and reach the write endpoints for CAPAs, certificates, ESG reports and
shipments.
- Use the one IsOpsOrAdmin from apps.compliance.permissions; drop the duplicate
copy in apps/qc/views.py.
- Apply it to the whole viewset on shipments, qc, capa, esg, documents,
certificates-of-analysis and regulatory-certs. The buyer portal is
server-rendered through the ORM, so it needs none of these APIs.
- Keep the buyer chat working: AI interactions stay authenticated and scoped,
and agent reads stay open while agent writes become ops/admin.
- Close a buyer-to-admin escalation in the users API: writes are admin-only and
role/is_active are read-only, so a buyer can no longer PATCH their own row to
role=admin and then pass every IsOpsOrAdmin check.
15 lines
532 B
Python
15 lines
532 B
Python
from rest_framework import viewsets
|
|
|
|
from apps.compliance.permissions import IsOpsOrAdmin
|
|
|
|
from .models import CAPARecord
|
|
from .serializers import CAPARecordSerializer
|
|
|
|
|
|
class CAPARecordViewSet(viewsets.ModelViewSet):
|
|
queryset = CAPARecord.objects.all()
|
|
serializer_class = CAPARecordSerializer
|
|
# Corrective actions are an internal ops record — the buyer portal does not
|
|
# read them at all, through the ORM or this API — so both read and write are
|
|
# closed to a buyer.
|
|
permission_classes = [IsOpsOrAdmin]
|