11 lines
414 B
Python
11 lines
414 B
Python
|
from rest_framework.permissions import BasePermission
|
||
|
|
|
||
|
|
|
||
|
|
class IsOwner(BasePermission):
|
||
|
|
"""Library items and albums are private by default — only the owner may
|
||
|
|
read or write them through these endpoints. Sharing happens explicitly
|
||
|
|
via Moments / AlbumCollaborators, handled by their own views."""
|
||
|
|
|
||
|
|
def has_object_permission(self, request, view, obj):
|
||
|
|
return obj.owner_id == request.user.id
|