Merge of Iowa and Isolinear features into master

requirements.txt

@@ -42,6 +42,7 @@ markdown
 maxminddb==2.5.1
 mock
 mozilla-django-oidc==4.0.1
+openpyxl==3.1.5
 orcid==1.0.3
 packaging==23.2
 pdfkit==1.0.0

src/api/permissions.py

@@ -1,7 +1,10 @@
 from django.core.exceptions import PermissionDenied
+from django.shortcuts import get_object_or_404
 
 from rest_framework import permissions
 
+from repository import models as rm
+
 
 class IsEditor(permissions.BasePermission):
     message = "Please ensure the user is an Editor or Staff Member."
@@ -29,3 +32,47 @@ def has_permission(self, request, view):
 
         if request.user.is_section_editor(request):
             return True
+
+
+class IsRepositoryManager(permissions.BasePermission):
+    message = 'Please ensure the user is a manager of this repository.'
+
+    def has_permission(self, request, view):
+        if request.user and not request.user.is_authenticated:
+            return False
+
+        if not request.repository:
+            return False
+
+        if request.user.is_staff:
+            return True
+
+        if request.repository and request.user in request.repository.managers.all():
+            return True
+
+
+class IsPreprintOwner(permissions.BasePermission):
+    message = 'You must be the owner of this preprint to edit it.'
+
+    def has_permission(self, request, view):
+        # grant access to non-create/update requests
+        if request.method not in ['PUT', 'PATCH', 'DELETE']:
+            return True
+
+        # grant access if user is the preprint's owner
+        preprint_id = request.data.get('pk')
+        if not preprint_id:
+            preprint_id = view.kwargs.get('pk')
+
+        preprint = get_object_or_404(
+            rm.Preprint,
+            pk=preprint_id,
+        )
+        if request.user == preprint.owner:
+            return True
+
+        if request.user.is_staff:
+            return True
+
+        # Otherwise don't grant access
+        return False