%9j*&jdZddlmZddlmZdZGddZGddeZGd d eZGd d Z Gd dZ GddZ Gddee Z Gdde ZGddeZGddeZGddeZGddeZGddeZGd d!eZGd"d#eZy$)%z2 Provides a set of pluggable permission policies. )Http404) exceptions)GETHEADOPTIONSc*eZdZdZdZdZdZdZy)OperationHolderMixinc$tt||SN OperandHolderANDselfothers V/var/www/html/truck-me/venv/lib/python3.12/site-packages/rest_framework/permissions.py__and__zOperationHolderMixin.__and__ sS$..c$tt||Sr r ORrs r__or__zOperationHolderMixin.__or__sRu--rc$tt||Sr r rs r__rand__zOperationHolderMixin.__rand__sS%..rc$tt||Sr rrs r__ror__zOperationHolderMixin.__ror__sR--rc"tt|Sr )SingleOperandHolderNOT)rs r __invert__zOperationHolderMixin.__invert__s"3--rN)__name__ __module__ __qualname__rrrrr rrr r s/./..rr ceZdZdZdZy)rc ||_||_yr )operator_class op1_class)rr'r(s r__init__zSingleOperandHolder.__init__s,"rcH|j|i|}|j|Sr )r(r')rargskwargsop1s r__call__zSingleOperandHolder.__call__!s(dnnd-f-""3''rN)r!r"r#r)r.r$rrrrs #(rrceZdZdZdZdZy)r c.||_||_||_yr )r'r( op2_class)rr'r(r1s rr)zOperandHolder.__init__'s,""rcn|j|i|}|j|i|}|j||Sr )r(r1r')rr+r,r-op2s rr.zOperandHolder.__call__,s?dnnd-f-dnnd-f-""3,,rct|txrO|j|jk(xr4|j|jk(xr|j|jk(Sr ) isinstancer r'r(r1rs r__eq__zOperandHolder.__eq__1sV um , .   5#7#7 7 . NNeoo - . NNeoo -  rN)r!r"r#r)r.r6r$rrr r &s# -  rr ceZdZdZdZdZy)rc ||_||_yr r-r3rr-r3s rr)z AND.__init__;rcv|jj||xr|jj||Sr r-has_permissionr3rrequestviews rr>zAND.has_permission?4 HH # #GT 2 3 HH # #GT 2 rcz|jj|||xr|jj|||Sr )r-has_object_permissionr3rr@rAobjs rrDzAND.has_object_permissionEs8 HH * *7D# > ? HH * *7D# > rNr!r"r#r)r>rDr$rrrr:s  rrceZdZdZdZdZy)rc ||_||_yr r9r:s rr)z OR.__init__Mr;rcv|jj||xs|jj||Sr r=r?s rr>zOR.has_permissionQrBrc|jj||xr|jj|||xs;|jj||xr|jj|||Sr )r-r>rDr3rEs rrDzOR.has_object_permissionWsn HH # #GT 2 C..wcB  HH # #GT 2 C..wcB  rNrGr$rrrrLs  rrceZdZdZdZdZy)rc||_yr )r-)rr-s rr)z NOT.__init__bs rc<|jj|| Sr )r-r>r?s rr>zNOT.has_permissiones88**7D999rc>|jj||| Sr )r-rDrEs rrDzNOT.has_object_permissionhs8811'4EEErNrGr$rrrras:Frrc eZdZy)BasePermissionMetaclassN)r!r"r#r$rrrQrQlsrrQceZdZdZdZdZy)BasePermissionzH A base class from which all permission classes should inherit. cyzL Return `True` if permission is granted, `False` otherwise. Tr$r?s rr>zBasePermission.has_permissionurcyrUr$rEs rrDz$BasePermission.has_object_permission{rVrN)r!r"r#__doc__r>rDr$rrrSrSps rrS) metaclassceZdZdZdZy)AllowAnyz Allow any access. This isn't strictly required, since you could use an empty permission_classes list, but it's useful because it makes the intention more explicit. cy)NTr$r?s rr>zAllowAny.has_permissionsrNr!r"r#rXr>r$rrr[r[s rr[ceZdZdZdZy)IsAuthenticatedz4 Allows access only to authenticated users. c\t|jxr|jjSr )booluseris_authenticatedr?s rr>zIsAuthenticated.has_permissions GLLBW\\%B%BCCrNr]r$rrr_r_s Drr_ceZdZdZdZy) IsAdminUserz, Allows access only to admin users. c\t|jxr|jjSr )rarbis_staffr?s rr>zIsAdminUser.has_permissions GLL:W\\%:%:;;rNr]r$rrreres z(IsAuthenticatedOrReadOnly.has_permissions9 NNl * * LL * LL ) )  rNr]r$rrriris  rricFeZdZdZdggdgdgdgdgdgdZdZdZd Zd Zy ) DjangoModelPermissionsa} The request is authenticated using `django.contrib.auth` permissions. See: https://docs.djangoproject.com/en/dev/topics/auth/#permissions It ensures that the user is authenticated, and has the appropriate `add`/`change`/`delete` permissions on the model. This permission can only be applied against view classes that provide a `.queryset` attribute. z!%(app_label)s.view_%(model_name)s %(app_label)s.add_%(model_name)s#%(app_label)s.change_%(model_name)s#%(app_label)s.delete_%(model_name)srrrPOSTPUTPATCHDELETETc|jj|jjd}||jvrt j ||j|Dcgc]}||z c}Scc}w)z Given a model and an HTTP method, return the list of permission codes that the user is required to have.  app_label model_name_metaryrz perms_maprMethodNotAllowedrrk model_clsr,perms rget_required_permissionsz/DjangoModelPermissions.get_required_permissionsse #22#//44   '--f5 5*...*@A$v AAA" A1c4t|ds7t|dd*Jdj|jjt|dr>|j }|*Jdj|jj|S|j S)N get_querysetquerysetz[Cannot apply {} on a view that does not set `.queryset` or have a `.get_queryset()` method.z{}.get_queryset() returned None)hasattrgetattrformat __class__r!rr)rrArs r _querysetz DjangoModelPermissions._querysetst^,tZ.: * > &(( )  *; 4 (((*H' 1889P9PQ 'O}}rc|jr"|jjs |jryt|ddry|j |}|j |j |j}|j d|j}|j}|j dk(r$|j|xs|j|S|j|S)NF_ignore_model_permissionsTrtr) rbrcauthenticated_users_onlyrrrrkmodel has_perms)rr@rArperms change_permrbs rr>z%DjangoModelPermissions.has_permissions||||,,1N1N 44e <>>$'--gnnhnnM33E8>>J || >>U ">>%(GDNN;,G G~~e$$rN) r!r"r#rXr}rrrr>r$rrrnrnsO 444534567889I $ B %rrnceZdZdZdZy)$DjangoModelPermissionsOrAnonReadOnlyzj Similar to DjangoModelPermissions, except that anonymous users are allowed read-only access. FN)r!r"r#rXrr$rrrrs %rrc8eZdZdZgggdgdgdgdgdZdZdZy) DjangoObjectPermissionsa The request is authenticated using Django's object-level permissions. It requires an object-permissions-enabled backend, such as Django Guardian. It ensures that the user is authenticated, and has the appropriate `add`/`change`/`delete` permissions on the object using .has_perms. This permission can only be applied against view classes that provide a `.queryset` attribute. rorprqrrc|jj|jjd}||jvrt j ||j|Dcgc]}||z c}Scc}w)Nrxr{rs rget_required_object_permissionsz7DjangoObjectPermissions.get_required_object_permissionssc"22#//44   '--f5 5*...*@A$v AAArc8|j|}|j}|j}|j|j|}|j ||sC|jt vrt|jd|}|j ||styy)NrFT)rrrbrrkrrlr) rr@rArFrrrbr read_permss rrDz-DjangoObjectPermissions.has_object_permission#s>>$'NN ||44W^^YO~~eS) ~~- ==eYOJ>>*c2 rN)r!r"r#rXr}rrDr$rrrrs< 34567889I BrrN)rX django.httprrest_frameworkrrlr rr rrrtyperQrSr[r_rerirnrrr$rrrs %) .."(.( ( (  $  *FF 2D 6$ ~ DnD<.<    K%^K%\%+A%949r