ixgadmin
8ad83a7a65
Batch writes were closed in 88eede5, but every other app's viewset still used
IsAuthenticated, which in this platform means any buyer. A buyer could rewrite a
document record, create a QC result (which moves the batch status and raises a
CAPA), and reach the write endpoints for CAPAs, certificates, ESG reports and
shipments.
- Use the one IsOpsOrAdmin from apps.compliance.permissions; drop the duplicate
copy in apps/qc/views.py.
- Apply it to the whole viewset on shipments, qc, capa, esg, documents,
certificates-of-analysis and regulatory-certs. The buyer portal is
server-rendered through the ORM, so it needs none of these APIs.
- Keep the buyer chat working: AI interactions stay authenticated and scoped,
and agent reads stay open while agent writes become ops/admin.
- Close a buyer-to-admin escalation in the users API: writes are admin-only and
role/is_active are read-only, so a buyer can no longer PATCH their own row to
role=admin and then pass every IsOpsOrAdmin check.
15 lines
538 B
Python
15 lines
538 B
Python
from rest_framework import viewsets
|
|
|
|
from apps.compliance.permissions import IsOpsOrAdmin
|
|
|
|
from .models import ESGFieldReport
|
|
from .serializers import ESGFieldReportSerializer
|
|
|
|
|
|
class ESGFieldReportViewSet(viewsets.ModelViewSet):
|
|
queryset = ESGFieldReport.objects.all()
|
|
serializer_class = ESGFieldReportSerializer
|
|
# The buyer portal reads ESG reports through the ORM
|
|
# (apps/buyer/views.py::BatchDetailView), not this API, so the API needs no
|
|
# buyer read and is closed to one.
|
|
permission_classes = [IsOpsOrAdmin]
|