Feature/fix permissions

api/v1/permissions.py

@@ -2,6 +2,8 @@
 from django.shortcuts import get_object_or_404
 from rest_framework import permissions
 
+from tasks.models import Task
+
 User = get_user_model()
 
 
@@ -23,4 +25,11 @@ def has_permission(self, request, view):
     def has_object_permission(self, request, view, obj):
         if request.user == obj.creator:
             return True
+        if isinstance(obj, Task):
+            if (
+                request.method == "PATCH"
+                and "status" in request.data
+                and request.data["status"] == "complete"
+            ):
+                return request.user == obj.executor
         return False

api/v1/serializers/api/task_serializer.py

@@ -13,6 +13,7 @@ class Meta:
             "name",
             "description",
             "creator",
+            "executor",
             "creation_date",
             "start_date",
             "end_date",

api/v1/tests/test_tasks_api.py

@@ -6,24 +6,33 @@
 
 from ipr.models import IPR
 from tasks.models import Task
+from users.models import Team
 
 User = get_user_model()
 
 
 class TaskAPITests(APITestCase):
     def setUp(self):
+        self.user0 = User.objects.create_user(
+            username="user0",
+            email="[email protected]",
+            password="password",
+        )
+        self.team1 = Team.objects.create(name="Team 1", boss=self.user0)
         self.user1 = User.objects.create_user(
             username="user1",
             email="[email protected]",
             password="password",
         )
+        self.team2 = Team.objects.create(name="Team 1", boss=self.user1)
         self.user2 = User.objects.create_user(
             username="user2",
             email="[email protected]",
             password="password",
+            team=self.team2,
         )
         self.client = APIClient()
-        self.client.force_authenticate(user=self.user2)
+        self.client.force_authenticate(user=self.user1)
         self.ipr = IPR.objects.create(
             title="Test IPR",
             creation_date=timezone.now().date(),
@@ -83,6 +92,26 @@ def test_create_task(self):
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
         self.assertEqual(Task.objects.count(), 3)
 
+    def test_create_task_for_other_user(self):
+        """
+        Проверка создания новой задачи для пол-ля другой команды (POST)
+        """
+        url = reverse("tasks-list")
+        data = {
+            "name": "New Task",
+            "description": "New Description",
+            "creator": self.user0.id,
+            "creation_date": timezone.now().date(),
+            "start_date": (timezone.now() + timezone.timedelta(days=1)).date(),
+            "end_date": (timezone.now() + timezone.timedelta(days=2)).date(),
+            "executor": self.user2.id,
+            "ipr": self.ipr.id,
+        }
+        response = self.client.post(url, data, format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+        self.assertEqual(Task.objects.count(), 3)
+
     def test_update_task(self):
         """
         Проверка обновления задачи (PATCH)

api/v1/views/task_views.py

@@ -1,7 +1,8 @@
 from django.contrib.auth import get_user_model
 from drf_spectacular.utils import extend_schema, extend_schema_view
-from rest_framework import viewsets
+from rest_framework import permissions, viewsets
 
+from api.v1.permissions import TeamBossPermission
 from api.v1.serializers.api.task_serializer import (
     TaskSerializer,
     TaskSerializerPost,
@@ -53,3 +54,8 @@ def get_serializer_class(self):
 
     def perform_create(self, serializer):
         serializer.save(creator=self.request.user)
+
+    def get_permissions(self):
+        if self.request.method not in permissions.SAFE_METHODS:
+            self.permission_classes = [TeamBossPermission]
+        return super(TaskViewSet, self).get_permissions()