Merge of Iowa and Isolinear features into master

.github/workflows/ci.yml

@@ -26,6 +26,7 @@ jobs:
       - name: Set up environment variables
         run: |
           echo "DB_VENDOR=sqlite" >> "$GITHUB_ENV"
+          echo "DB_NAME=:memory:" >> "$GITHUB_ENV"
           echo "JANEWAY_SETTINGS_MODULE=core.janeway_global_settings" >> "$GITHUB_ENV"
 
 

requirements.txt

@@ -42,6 +42,7 @@ markdown
 maxminddb==2.5.1
 mock
 mozilla-django-oidc==4.0.1
+openpyxl==3.1.5
 orcid==1.0.3
 packaging==23.2
 pdfkit==1.0.0

src/api/permissions.py

@@ -1,7 +1,10 @@
 from django.core.exceptions import PermissionDenied
+from django.shortcuts import get_object_or_404
 
 from rest_framework import permissions
 
+from repository import models as rm
+
 
 class IsEditor(permissions.BasePermission):
     message = "Please ensure the user is an Editor or Staff Member."
@@ -29,3 +32,47 @@ def has_permission(self, request, view):
 
         if request.user.is_section_editor(request):
             return True
+
+
+class IsRepositoryManager(permissions.BasePermission):
+    message = "Please ensure the user is a manager of this repository."
+
+    def has_permission(self, request, view):
+        if request.user and not request.user.is_authenticated:
+            return False
+
+        if not request.repository:
+            return False
+
+        if request.user.is_staff:
+            return True
+
+        if request.repository and request.user in request.repository.managers.all():
+            return True
+
+
+class CanEditPreprint(permissions.BasePermission):
+    message = "You must be the owner of this preprint to edit it."
+
+    def has_permission(self, request, view):
+        # grant access to non-create/update requests
+        if request.method not in ["PUT", "PATCH", "DELETE"]:
+            return True
+
+        # grant access if user is the preprint's owner
+        preprint_id = request.data.get("pk")
+        if not preprint_id:
+            preprint_id = view.kwargs.get("pk")
+
+        preprint = get_object_or_404(
+            rm.Preprint,
+            pk=preprint_id,
+        )
+        if request.user == preprint.owner:
+            return True
+
+        if request.user.is_staff:
+            return True
+
+        # Otherwise don't grant access
+        return False