diff --git a/apps/api/views.py b/apps/api/views.py index 93a1abb..d9626d0 100644 --- a/apps/api/views.py +++ b/apps/api/views.py @@ -3,7 +3,8 @@ import logging from django_filters import rest_framework as rest_filters -from rest_framework import permissions, filters, generics +from rest_framework import permissions, filters, generics, status +from rest_framework.response import Response from rest_framework.pagination import PageNumberPagination from rest_framework.authentication import SessionAuthentication, TokenAuthentication from rest_framework.parsers import MultiPartParser, FormParser @@ -93,13 +94,25 @@ class Server_ListView(ListView): return Server.objects.filter(id__in=servers).order_by("id") -class Server_DetailView(DetailView): +class Server_DetailView(DeletableDetailView): serializer_class = ServerSerializer def get_queryset(self): servers = ServerMember.objects.filter(user=self.request.user).values_list("server", flat=True) return Server.objects.filter(id__in=servers) + def destroy(self, request, *args, **kwargs): + server = self.get_object() + member = ServerMember.objects.get(server=server, user=request.user) + + if not member.is_owner: + return Response( + {"detail": "Only the owner can destroy server data."}, + status=status.HTTP_403_FORBIDDEN + ) + + return super().destroy(request, *args, **kwargs) + # region Filters