Fixes: #14634 - Bypass Write permissions for render endpoint

[DanSheps]

Fixes: #14634 - Bypass Write permissions for render endpoint

• Bypass permission for render endpoint by swapping the permissions map and overriding the restrict() action.

[jeremystretch]

@DanSheps are you still working on this?

[DanSheps]

Yes, sorry, I will get back on it. Trying to find an elegant way to do this.

[DanSheps]

We could alternatively modify:

class BaseViewSet(GenericViewSet):
    """
    Base class for all API ViewSets. This is responsible for the enforcement of object-based permissions.
    """
    def initial(self, request, *args, **kwargs):
        super().initial(request, *args, **kwargs)

        # Restrict the view's QuerySet to allow only the permitted objects
        if request.user.is_authenticated:
            if action := HTTP_ACTIONS[request.method]:
                self.queryset = self.queryset.restrict(request.user, action)

to account for permissions using:

self.get_permissions() and using the resulting perms_map to determine what permission should be applied.

This is a down the road thing IMO though.

[jeremystretch]

We'll definitely need to identify a more maintainable solution. This will probably entail digging into DRF permissions logic a bit.

[DanSheps]

As mentioned above, I think we can figure out something by modifying the BaseViewSet and then adjusting the queryset based on that.

I will take a second crack at this on the weekend.

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity. It will be closed automatically if no further action is taken.

[DanSheps]

Need to get back to this.