diff --git a/connection/views.py b/connection/views.py index bfb676c..0bb80c7 100644 --- a/connection/views.py +++ b/connection/views.py @@ -11,6 +11,7 @@ import importlib import json from .serializers import ConnectionSerializer, ConnectionTypeSerializer from django.db import transaction +from qrtr_account.mixins import OwnedAccountsMixin # Create your views here. @@ -20,7 +21,7 @@ class ConnectionTypeViewSet(viewsets.ModelViewSet): serializer_class = ConnectionTypeSerializer -class ConnectionViewSet(viewsets.ModelViewSet): +class ConnectionViewSet(viewsets.ModelViewSet, OwnedAccountsMixin): """API endpoint that allows connections to be seen or created """ permission_classes = [IsAuthenticated] @@ -33,7 +34,10 @@ class ConnectionViewSet(viewsets.ModelViewSet): 'delete', 'options'] - + def get_queryset(self): + return Connection.objects.filter( + account__in=self.accessible_accounts().values_list('id')) + @action(detail=False, methods=['post'], url_path='plaid/exchange_public_token') def exchange_public_token(self, request): print(f"REQUEST: {request.data}") @@ -76,9 +80,6 @@ class ConnectionViewSet(viewsets.ModelViewSet): conn.save() return Response(plaid_client.get_accounts()) - - - @action(detail=False, methods=['post'], url_path='plaid') def authenticate(self, request): print(request.data) diff --git a/qrtr_account/views.py b/qrtr_account/views.py index dd6fda5..aa30185 100644 --- a/qrtr_account/views.py +++ b/qrtr_account/views.py @@ -1,5 +1,4 @@ from django.shortcuts import render -from django.db.models import Q from rest_framework import viewsets, mixins from .models import Account, BankAccount, Institution, Transaction, Slice, Rule, SubscriptionPlan from rest_framework.permissions import IsAuthenticated @@ -18,19 +17,7 @@ from dj_rest_auth.registration.views import SocialLoginView from allauth.socialaccount.providers.twitter.views import TwitterOAuthAdapter from dj_rest_auth.social_serializers import TwitterLoginSerializer from api.mixins import ReadWriteSerializerMixin - - -class OwnedAccountsMixin(): - """Mixin to help getting a list of accounts - the given user is authorized to see - """ - - def accessible_accounts(self): - usr = self.request.user - accs = Account.objects.filter(Q(owner=usr) | - Q(id__in=usr.admin_accounts.all().values_list('id')) | - Q(id__in=usr.view_accounts.all().values_list('id'))) - return accs +from qrtr_account.mixins import OwnedAccountsMixin class TwitterLogin(SocialLoginView): @@ -94,11 +81,13 @@ class SliceViewSet(viewsets.ModelViewSet, OwnedAccountsMixin): bank_acc__qrtr_account__in=self.accessible_accounts().values_list('id') ) + class SubscriptionPlanViewSet(viewsets.ModelViewSet): queryset = SubscriptionPlan.objects.all() serializer_class = SubscriptionPlanSerializer + class InstitutionViewSet(viewsets.ReadOnlyModelViewSet): """API endpoint that allows BankAccounts to be viewed. """