From 3b635cf17a4538887278763155b71c63e16f3375 Mon Sep 17 00:00:00 2001 From: aserrador Date: Mon, 22 Jun 2026 11:18:08 -0500 Subject: [PATCH] =?UTF-8?q?feat:=20cat=C3=A1logo=20p=C3=BAblico=20sin=20au?= =?UTF-8?q?tenticaci=C3=B3n,=20solo=20confirmar=20compra=20requiere=20auth?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Cambia default global de IsAuthenticated a AllowAny en settings/base.py - ProductView: AllowAny para GET, IsAuthenticated para POST/PUT/DELETE - CatalogueImageViewSet: AllowAny para reads, IsAuthenticated+Admin para writes - PaymentMethodView: AllowAny (público) - SaleView, CatalogSaleView, SaleSummary, CatalogSaleSummary: IsAuthenticated - CustomerView: IsAuthenticated --- tienda_ilusion/config/settings/base.py | 2 +- tienda_ilusion/don_confiao/api/catalogue_images.py | 4 ++-- tienda_ilusion/don_confiao/api/customers.py | 1 + tienda_ilusion/don_confiao/api/payments.py | 4 +++- tienda_ilusion/don_confiao/api/products.py | 7 ++++++- tienda_ilusion/don_confiao/api/sales.py | 6 ++++++ 6 files changed, 19 insertions(+), 5 deletions(-) diff --git a/tienda_ilusion/config/settings/base.py b/tienda_ilusion/config/settings/base.py index 45e9560..c11cf08 100644 --- a/tienda_ilusion/config/settings/base.py +++ b/tienda_ilusion/config/settings/base.py @@ -166,7 +166,7 @@ REST_FRAMEWORK = { "rest_framework_simplejwt.authentication.JWTAuthentication", ], "DEFAULT_PERMISSION_CLASSES": [ - "rest_framework.permissions.IsAuthenticated", + "rest_framework.permissions.AllowAny", ], } diff --git a/tienda_ilusion/don_confiao/api/catalogue_images.py b/tienda_ilusion/don_confiao/api/catalogue_images.py index 1b0ac7e..fcb5d27 100644 --- a/tienda_ilusion/don_confiao/api/catalogue_images.py +++ b/tienda_ilusion/don_confiao/api/catalogue_images.py @@ -1,5 +1,5 @@ from rest_framework import viewsets -from rest_framework.permissions import IsAuthenticated +from rest_framework.permissions import AllowAny, IsAuthenticated from ..image_service import resize_catalogue_image from ..models.catalogue_images import CatalogueImage @@ -14,7 +14,7 @@ class CatalogueImageViewSet(viewsets.ModelViewSet): def get_permissions(self): if self.action in ("create", "update", "partial_update", "destroy"): return [IsAuthenticated(), IsAdministrator()] - return [IsAuthenticated()] + return [AllowAny()] def perform_create(self, serializer): instance = serializer.save() diff --git a/tienda_ilusion/don_confiao/api/customers.py b/tienda_ilusion/don_confiao/api/customers.py index 01b136c..533e0ad 100644 --- a/tienda_ilusion/don_confiao/api/customers.py +++ b/tienda_ilusion/don_confiao/api/customers.py @@ -13,6 +13,7 @@ from ..services.tryton.client import get_tryton_client class CustomerView(viewsets.ModelViewSet): queryset = Customer.objects.all() serializer_class = CustomerSerializer + permission_classes = [IsAuthenticated] class CustomersFromTrytonView(APIView): diff --git a/tienda_ilusion/don_confiao/api/payments.py b/tienda_ilusion/don_confiao/api/payments.py index 1ceeb1f..acae0ab 100644 --- a/tienda_ilusion/don_confiao/api/payments.py +++ b/tienda_ilusion/don_confiao/api/payments.py @@ -3,7 +3,7 @@ from rest_framework.views import APIView from rest_framework.response import Response from rest_framework.status import HTTP_400_BAD_REQUEST from rest_framework.pagination import PageNumberPagination -from rest_framework.permissions import IsAuthenticated +from rest_framework.permissions import AllowAny, IsAuthenticated from decimal import Decimal from ..models.sales import Sale @@ -87,6 +87,8 @@ class ReconciliateJarModelView(viewsets.ModelViewSet): class PaymentMethodView(APIView): + permission_classes = [AllowAny] + def get(self, request): serializer = PaymentMethodSerializer(PaymentMethods.choices, many=True) return Response(serializer.data) diff --git a/tienda_ilusion/don_confiao/api/products.py b/tienda_ilusion/don_confiao/api/products.py index 9f39195..7387924 100644 --- a/tienda_ilusion/don_confiao/api/products.py +++ b/tienda_ilusion/don_confiao/api/products.py @@ -1,7 +1,7 @@ from rest_framework import viewsets from rest_framework.views import APIView from rest_framework.response import Response -from rest_framework.permissions import IsAuthenticated +from rest_framework.permissions import AllowAny, IsAuthenticated from ..models.products import Product from ..serializers import ProductSerializer @@ -14,6 +14,11 @@ class ProductView(viewsets.ModelViewSet): queryset = Product.objects.all() serializer_class = ProductSerializer + def get_permissions(self): + if self.action in ("list", "retrieve"): + return [AllowAny()] + return [IsAuthenticated()] + def get_queryset(self): """ Filters products by active status for list operations. diff --git a/tienda_ilusion/don_confiao/api/sales.py b/tienda_ilusion/don_confiao/api/sales.py index ef4cde7..085ca29 100644 --- a/tienda_ilusion/don_confiao/api/sales.py +++ b/tienda_ilusion/don_confiao/api/sales.py @@ -23,6 +23,7 @@ from ..views import sales_to_tryton_csv class SaleView(viewsets.ModelViewSet): queryset = Sale.objects.all() serializer_class = SaleSerializer + permission_classes = [IsAuthenticated] def create(self, request): data = request.data @@ -58,9 +59,12 @@ class SaleView(viewsets.ModelViewSet): class CatalogSaleView(viewsets.ModelViewSet): queryset = CatalogSale.objects.all() serializer_class = CatalogSaleSerializer + permission_classes = [IsAuthenticated] class SaleSummary(APIView): + permission_classes = [IsAuthenticated] + def get(self, request, id): sale = Sale.objects.get(pk=id) serializer = SaleSummarySerializer(sale) @@ -68,6 +72,8 @@ class SaleSummary(APIView): class CatalogSaleSummary(APIView): + permission_classes = [IsAuthenticated] + def get(self, request, id): catalog_sale = CatalogSale.objects.get(pk=id) serializer = CatalogSaleSummarySerializer(catalog_sale)