77 lines
2.2 KiB
Python
77 lines
2.2 KiB
Python
"""
|
|
Custom Permission Classes for Multi-Tenancy Security
|
|
|
|
These permission classes enforce organization context and access control
|
|
across all API endpoints.
|
|
"""
|
|
|
|
from rest_framework import permissions
|
|
|
|
|
|
class HasOrgContext(permissions.BasePermission):
|
|
"""
|
|
Permission class that requires valid organization context.
|
|
|
|
This should be used on all endpoints that require org-scoped data access.
|
|
It verifies that:
|
|
1. User is authenticated
|
|
2. request.profile is set (from middleware)
|
|
3. request.org is set (from JWT or API key)
|
|
|
|
Usage:
|
|
class MyView(APIView):
|
|
permission_classes = [IsAuthenticated, HasOrgContext]
|
|
"""
|
|
|
|
message = "Organization context is required. Please login again."
|
|
|
|
def has_permission(self, request, view):
|
|
# Must have profile set by middleware
|
|
if not hasattr(request, "profile") or request.profile is None:
|
|
return False
|
|
|
|
# Must have org set
|
|
if not hasattr(request, "org") or request.org is None:
|
|
return False
|
|
|
|
# Profile must be active
|
|
if not request.profile.is_active:
|
|
return False
|
|
|
|
return True
|
|
|
|
|
|
class IsOrgAdmin(permissions.BasePermission):
|
|
"""
|
|
Permission class that requires user to be an organization admin.
|
|
|
|
Usage:
|
|
class AdminOnlyView(APIView):
|
|
permission_classes = [IsAuthenticated, HasOrgContext, IsOrgAdmin]
|
|
"""
|
|
|
|
message = "You must be an organization administrator to perform this action."
|
|
|
|
def has_permission(self, request, view):
|
|
if not hasattr(request, "profile") or request.profile is None:
|
|
return False
|
|
|
|
return request.profile.role == "ADMIN" or request.profile.is_organization_admin
|
|
|
|
|
|
class IsSuperAdmin(permissions.BasePermission):
|
|
"""
|
|
Permission class for platform-level super admins.
|
|
|
|
Super admins are identified by @micropyramid.com email domain.
|
|
They have access to admin panel and can manage all organizations.
|
|
"""
|
|
|
|
message = "Super admin access required."
|
|
|
|
def has_permission(self, request, view):
|
|
if not request.user or not request.user.is_authenticated:
|
|
return False
|
|
|
|
# Check for super admin email domain
|
|
return request.user.email.endswith("@micropyramid.com")
|