forked from erp-dev/erp
27 lines
732 B
Python
27 lines
732 B
Python
from rest_framework.permissions import BasePermission
|
|
|
|
|
|
class IsCoreSuperAdmin(BasePermission):
|
|
"""
|
|
Core APIs are reserved for Django superusers with a bound Employee merchant.
|
|
"""
|
|
|
|
message = "需要 superadmin 权限并绑定有效员工商户"
|
|
|
|
def has_permission(self, request, view):
|
|
user = request.user
|
|
if not user or not user.is_authenticated:
|
|
return False
|
|
if not user.is_superuser:
|
|
return False
|
|
|
|
employee = getattr(user, "employee", None)
|
|
if employee is None:
|
|
return False
|
|
if getattr(employee, "merchant_id", None) is None:
|
|
return False
|
|
|
|
request.core_merchant = employee.merchant
|
|
return True
|
|
|