API V3: change permissions to allow anonymous access to public resources #11485
Conversation
| if self.name: | ||
| return self.name |
There was a problem hiding this comment.
If there is a name, that should always take precedence.
Otherwise, we end with something like Projects None
https://app.readthedocs.org/api/v3/projects/stsewd-demo/superproject/
There was a problem hiding this comment.
I ran into this while working on sync-versions, and glad to see it fixed :)
| if self.name: | ||
| return self.name |
There was a problem hiding this comment.
I ran into this while working on sync-versions, and glad to see it fixed :)
| # Any other action is read-only. | ||
| else: | ||
| permission_classes = [ReadOnlyPermission] | ||
| return [permission() for permission in permission_classes] |
There was a problem hiding this comment.
Interesting that you need to instantiate them.
| @@ -238,7 +252,7 @@ class SubprojectRelationshipViewSet( | |||
| model = ProjectRelationship | |||
| lookup_field = "alias" | |||
| lookup_url_kwarg = "alias_slug" | |||
| queryset = ProjectRelationship.objects.all() | |||
| permission_classes = [ReadOnlyPermission | (IsAuthenticated & IsProjectAdmin)] | |||
There was a problem hiding this comment.
Why do we need this defined when we have the permissions setup in the APIv3Settings object?
There was a problem hiding this comment.
APIv3Settings no longer has a default permission class, each view needs to explicitly declare the permissions. This is since each view requires different permissions.
.apito filter resources by the current user, if anything extra is needed, each view can override the queryset.Ref readthedocs/ext-theme#154