Python rest_framework.permissions 模块，SAFE_METHODS 实例源码

def has_permission(self, request, view):
        if request.method in SAFE_METHODS:
            return True

        if not request.user.is_authenticated:
            return False

        return True

def has_object_permission(self, request, view, obj):
        """Summary

        Args:
            request (TYPE): Description
            view (TYPE): Description
            obj (TYPE): Description

        Returns:
            TYPE: Description
        """
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        if request.method in SAFE_METHODS:
            return True

        # Instance must have an attribute named `owner`.
        return obj.owner == request.user

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True

        # User should be active
        if not request.user.is_active:
            self.message = 'User is not active.'
            return False

        # Superuser can control any user
        if request.user.is_superuser:
            return True
        if request.user.pk != obj.pk:
            return False
        if request.user.emailaddress_set.exists() and not request.user.emailaddress_set.first().verified:
            self.message = 'Please activate your user via confirm email.'
            return False
        return True

# Custom rest_framework jwt response

def has_permission(self, request, view):
        """Allow only admins to create results
        Arguments:
            request (rest_framework.request.Request): request to check for
        """

        if request.method in permissions.SAFE_METHODS:
            return True

        if not request.user or not request.user.is_authenticated():
            return False

        if 'AnalysisJobViewSet' == view.__class__.__name__:
            return is_admin(request.user)
        elif ('OrganizationViewSet' == view.__class__.__name__ and
              is_admin(request.user) and is_admin_org(request.user)):
            return True
        else:
            return request.user.role in UserRoles.DEFAULT_CREATE

def get_current_version(self, obj):
        """
        Return current version ID for non-edit methods, otherwise 'Unknown'.

        When editing, a new version will be created by django-reversion.
        However, due to transaction timing the ID for this new Version hasn't
        yet been generated and stored by the time the response for the editing
        API call is generated. Rather than return the old, incorrect ID, we
        simply report 'Unknown' for editing API calls.

        An editing app will need to perform a new GET request to get the new
        version ID for the object.
        """
        if self.context['request'].method in permissions.SAFE_METHODS:
            try:
                return reversion.get_for_date(obj, timezone.now()).id
            except Version.DoesNotExist:
                return 'Unknown'
        else:
            return 'Unknown'

def has_permission(self, request, view):

        # the Django REST Framework browseable API calls this to see what buttons to show
        if not request.data:
            return True

        # we allow anyone to read certificates
        if request.method in permissions.SAFE_METHODS:
            return True

        # other than read (or other safe) operations, we only allow POST
        if request.method == "POST":
            # check that the authenticated user has the appropriate permissions to create the certificate
            if hasattr(request.user, "has_morango_certificate_scope_permission"):
                scope_definition_id = request.data.get("scope_definition")
                scope_params = json.loads(request.data.get("scope_params"))
                if scope_definition_id and scope_params and isinstance(scope_params, dict):
                    return request.user.has_morango_certificate_scope_permission(scope_definition_id, scope_params)
            return False

        return False

def has_permission(self, request, view):

        if request.method in permissions.SAFE_METHODS:
            return True
        elif request.method in ['DELETE', 'PATCH', 'PUT', 'POST']:
            try:
                challenge = Challenge.objects.get(pk=request.parser_context['kwargs']['challenge_pk'])
            except Challenge.DoesNotExist:
                return False

            if request.user.id == challenge.creator.created_by.id:
                return True
            else:
                return False
        else:
            return False

def has_object_permission(self, request, view, obj):
        '''
        Perform the check
        '''
        owner_object = obj.get_owner_object() if hasattr(obj, 'get_owner_object') else False

        # Owner
        if owner_object and owner_object.user == request.user:
            return True

        # 'global' objects only for GET, HEAD or OPTIONS
        if not owner_object and request.method in permissions.SAFE_METHODS:
            return True

        # Everything else is a no-no
        return False

def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True

        return obj.user == request.user

def has_permission(self, request, view):
        if request.method in SAFE_METHODS:
            return True

        if request.user.is_authenticated:
            return True

        return False

def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True

        if request.user.is_authenticated:
            if view.action == "share" or obj.author == request.user.profile:
                return True

        return False

def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        if request.method in SAFE_METHODS:
            return True
        elif request.method in ('POST', 'PUT', 'DELETE'):
            return True

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        return obj == request.user

def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        if request.method in permissions.SAFE_METHODS:
            return True

        # Instance must have an attribute named `owner`.
        return obj.owner == request.user

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True

        return obj.author == request.user

def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        # if request.method in permissions.SAFE_METHODS:
        # Write permissions are only allowed to the owner of the snippet.
        if request.user.is_staff:
            return True
        else:
            return obj.owner == request.user

def has_permission(self, request, view):

        if request.method not in permissions.SAFE_METHODS:
            return is_admin(request.user) and is_admin_org(request.user)
        else:
            return True

def has_permission(self, request, view):
        """Allow access to admins or if safe method"""

        if not request.user or not request.user.is_authenticated():
            return False

        if is_admin(request.user) or is_org_admin(request.user):
            return True

        if view.action in self.ALLOWED_ACTIONS or request.method in permissions.SAFE_METHODS:
            return True

        return False

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return  True
        return request.user.is_superuser

def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        if request.method in permissions.SAFE_METHODS:
            return True

        # Write permissions are only allowed to the owner of the snippet.
        return obj.user == request.user

def has_permission(self, request, view):
        if request.method in permissions.SAFE_METHODS:
            return True
        else:
            if request.auth and hasattr(request.auth, 'scope'):
                required_scopes = self.get_scopes(request, view)
                token_valid = request.auth.is_valid(required_scopes)
                user_verified = EmailAddress.objects.get(
                    user=request.user).verified
                return token_valid and user_verified
            if request.user and request.user.is_authenticated():
                # Avoiding try/except; we think this will work for any user.
                return EmailAddress.objects.get(user=request.user).verified

        return False

def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        if request.method in permissions.SAFE_METHODS:
            return True

        # Instance must have an attribute named `owner`.
        return obj.owner == request.user

def has_object_permission(self, request, view, obj):
        """Read permissions are allowed to any request."""
        if request.method in permissions.SAFE_METHODS:
            return True

        # Write permissions are only allowed to the owner of the snippet
        return obj.owner == request.user  # This came from imager. might need changes.

def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        if request.method in permissions.SAFE_METHODS:
            return True

        # Write permissions are only allowed to the owner of the snippet.
        return obj == request.user

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        return obj.business.user == request.user or request.user.is_superuser

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        return obj.user == request.user or request.user.is_superuser

def has_permission(self, request, view):
        """
        Return `True` if permission is granted, `False` otherwise.
        """
        return request.method in permissions.SAFE_METHODS or request.user.is_superuser

def has_permission(self, request, view):
        """
        Return `True` if permission is granted, `False` otherwise.
        """
        return request.method in permissions.SAFE_METHODS or request.user.is_superuser

def has_object_permission(self, request, view, obj):
        # anyone can read i.e. GET, OPTIONS, etc
        if request.method in permissions.SAFE_METHODS:
            return True

        return obj.user == request.user

def has_object_permission(self, request, view, obj):
        # note that there is no entry for POST here, as creation is handled by `has_permission`, above
        if request.method in permissions.SAFE_METHODS:  # 'GET', 'OPTIONS' or 'HEAD'
            return request.user.can_read(obj)
        elif request.method in ["PUT", "PATCH"]:
            return request.user.can_update(obj)
        elif request.method == "DELETE":
            return request.user.can_delete(obj)
        else:
            return False

def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True

        if request.method == 'DELETE':
            return request.user.can_manage_content

        return False

def has_permission(self, request, view):
        if request.method in permissions.SAFE_METHODS:
            return True

        if request.user.is_authenticated():
            return request.user.profile.confirmed or request.user.is_superuser
        else:
            return False

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True

        if request.user.is_authenticated():
            return request.user.profile.confirmed or request.user.is_superuser
        else:
            return False

def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to everyone
        if request.method in permissions.SAFE_METHODS:
            return True

        # Write permissions are only allowed to the club representative.
        return obj.channel.club.has_rep(request.user)

def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to only club members
        if request.method in permissions.SAFE_METHODS:
            return obj.channel.club.has_member(request.user)

        # Write permissions are denied to everyone.
        return False

def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to everyone
        if request.method in permissions.SAFE_METHODS:
            return True

        # Only allow a user to edit his/her details
        return obj == request.user

def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to everyone
        if request.method in permissions.SAFE_METHODS:
            return True
        # Only allow a secretary to delete
        if request.method == 'DELETE':
            return request.user.is_secretary()
        # Only allow a secretary or club representative to update
        return request.user.is_secretary() or \
            obj.has_rep(request.user)

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            # Only allow the club members to view
            return obj.club.has_member(request.user)

        # Only allow the club representative to edit
        return obj.club.has_rep(request.user)

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return obj.author == request.user \
                    or request.user.is_secretary() \
                    or obj.club.has_rep(request.user)
        # Do not allow write permissions to anyone
        return False

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return obj.parent.author == request.user \
                    or request.user.is_secretary() \
                    or obj.parent.club.has_rep(request.user)

        # Do not allow anyone to modify or delete
        return False

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return request.user.is_secretary() or \
                    obj.has_club_member(request.user)
        # Do not allow anyone to delete a Project.
        if request.method == 'DELETE':
            return False
        # Allow write permissions to only the owner club representative
        return obj.owner_club.has_rep(request.user)

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            # Only allow the members of parent clubs to view details.
            return obj.project.has_club_member(request.user)

        if request.method == 'DELETE':
            # Only allow the leader and rep of the club to delete.
            return obj.project.has_leader(request.user) or \
                obj.club.has_rep(request.user)

        # Do not allow anyone to edit
        return False

def has_object_permission(self, request, view, obj):
        if request.method not in permissions.SAFE_METHODS:
            # Do not allow anyone to modify/delete
            return False

        # Only allow access to the requester or the representative of the club
        # for which the request is made
        if obj.club.has_rep(request.user) or \
           obj.user == request.user:
            return True
        return False

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        return obj.owner == request.user.profile

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        return obj.user == request.user

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True

        return request.user.is_staff

def has_permission(self, request, view):
        if request.method in SAFE_METHODS:
            return True

        return request.user.is_staff

def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True

        return obj.created_by == request.user

def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True

        return obj.pk == request.user.pk

def has_object_permission(self, request, view, obj):
        """Check user is trying to edit their own profile."""

        if request.method in permissions.SAFE_METHODS:
            return True

        return obj.id == request.user.id