[change] Notification preferences: respect Django permissions

[nemesifier]

Continuation of #290.

• Allow staff users which are not superusers but have permission to change notification settings to open the view
• Respect notification preferences permissions in RET API (allow staff users with the change permission to make changes, staff users without the permission shall not be able to perform changes, superusers can always perform changes)
• Show the notification preferences button also if the user is just staff but has notification permissions

[panagiotisevaggelou]

Hi @nemesifier,
I found this issue in the backlog and decided to give it a try. After looking through the codebase, I wanted to clarify a point about the expected behavior:

1. I noticed that these two requirements:

   • Allow staff users which are not superusers but have permission to change notification settings to open the view
   • Show the notification preferences button also if the user is just staff but has notification permissions

   are essentially linked - if the button isn’t visible to a user, they can’t access (and therefore change) the notification preferences.

   So, should the notification settings button be visible only to:

   • superusers
   • users for their own settings
   • staff users with the permission

   and hidden for everyone else?

2. Also, should staff users with the change_notification_settings permission also be able to access and modify someone else’s preferences?

Thanks in advance for your help!

[nemesifier]

Hi @nemesifier, I found this issue in the backlog and decided to give it a try. After looking through the codebase, I wanted to clarify a point about the expected behavior:

1. I noticed that these two requirements:

   • Allow staff users which are not superusers but have permission to change notification settings to open the view
   • Show the notification preferences button also if the user is just staff but has notification permissions

   are essentially linked - if the button isn’t visible to a user, they can’t access (and therefore change) the notification preferences.
   So, should the notification settings button be visible only to:

   • superusers
   • users for their own settings
   • staff users with the permission

   and hidden for everyone else?

Yes. Staff users only if they have permissions to change notification preferences.

The API should also check whether non superusers have permissions to change (for HTTP POST/PUT) or view (HTTP GET), I believe now the REST API doesn't do this check and just allows any org manager to view and change, regardless of whether they have the permissions to view/change notification settings assigned or not.

See: https://openwisp.io/docs/dev/users/developer/django-rest-framework-utils.html#djangomodelpermissions.

2. Also, should staff users with the change_notification_settings permission also be able to access and modify someone else’s preferences?

If that someone else is member of an org they manage, yes.

See:

• https://openwisp.io/docs/dev/users/developer/misc-utils.html#organization-membership-helpers
• https://openwisp.io/docs/dev/users/developer/django-rest-framework-utils.html#mixins-for-multi-tenancy