24 lines
1.4 KiB
Python
24 lines
1.4 KiB
Python
from django.core.exceptions import PermissionDenied
|
|
from django.shortcuts import get_object_or_404
|
|
from apps.tickets.policies import TicketPolicy
|
|
from apps.accounts.magic_access import get_ticket_magic_access
|
|
from .delivery import attachment_response
|
|
from .models import Attachment
|
|
from django.views.decorators.cache import never_cache
|
|
def _authorized_attachment(request,public_id):
|
|
attachment=get_object_or_404(Attachment.objects.select_related("message__ticket"),public_id=public_id); ticket=attachment.message.ticket
|
|
magic_link = None if request.user.is_authenticated else get_ticket_magic_access(request,ticket)
|
|
if not TicketPolicy.can_view(request.user,ticket) and not magic_link: raise PermissionDenied
|
|
from apps.tickets.dispatch_responses import can_read_response
|
|
actor = ticket.customer if magic_link else request.user
|
|
if not can_read_response(actor, attachment.message): raise PermissionDenied
|
|
if attachment.message.is_internal and (magic_link or getattr(request.user,"account_type",None)=="CUSTOMER"): raise PermissionDenied
|
|
if attachment.message.deleted_at and not request.user.has_perm("messaging.view_deleted_message_content"): raise PermissionDenied
|
|
return attachment
|
|
@never_cache
|
|
def view(request,public_id):
|
|
return attachment_response(_authorized_attachment(request, public_id))
|
|
@never_cache
|
|
def download(request,public_id):
|
|
return attachment_response(_authorized_attachment(request, public_id), download=True)
|