ixgadmin
b376c30300
A buyer account is a legitimate authenticated user, so IsAuthenticated alone lets it through. Sweep every ModelViewSet endpoint and assert a buyer gets 403 on write, and on read where the API is ops-only; assert ops is not forbidden; and keep an explicit allowlist for the chat, user, notification and subscription reads a buyer may still make. Also assert the escalation is closed: a buyer cannot PATCH their own role to admin, sees only themselves in the user API, and cannot reach another user's notification or subscription. |
||
|---|---|---|
| .. | ||
| management | ||
| static/vendor/leaflet | ||
| __init__.py | ||
| apps.py | ||
| middleware.py | ||
| tests.py | ||
| tiles.py | ||