search

rcpch / national-paediatric-diabetes-audit

A django application to audit the care of children and young people with diabetes in England and Wales.
0 stars 1 forks source link

Permissions mixin #13

Open eatyourpeas opened 2 months ago

eatyourpeas commented 2 months ago

Allied to #12 As we are using class-based views, we can leverage Permissions mixins. These need implementing to constrain views so that:

  1. only logged in users can view endpoints
  2. users can only view/edit/delete (based on permission) children in their own PDU
  3. rcpch audit team can view/edit/delete nationally
eatyourpeas commented 2 months ago

The django LoginPermissionsMixin has been added to all views in PR #19 A custom permissions mixin will be needed to constrain users access to their own organisations children, as well as what they can do within their organisation, based on their role