raise PermissionDenied if someone tries to save an object without can_update rights

[plstackapi.git] / planetstack / core / models / plcorebase.py

diff --git a/planetstack/core/models/plcorebase.py b/planetstack/core/models/plcorebase.py
index d461c9d..b9692c6 100644 (file)
--- a/planetstack/core/models/plcorebase.py
+++ b/planetstack/core/models/plcorebase.py
@@ -5,6 +5,7 @@ from django.forms.models import model_to_dict
 from django.core.urlresolvers import reverse
 from django.forms.models import model_to_dict
 from django.utils import timezone
+from django.core.exceptions import PermissionDenied
 import model_policy
 
 try:
@@ -69,6 +70,7 @@ class PlCoreBase(models.Model):
     def __init__(self, *args, **kwargs):
         super(PlCoreBase, self).__init__(*args, **kwargs)
         self.__initial = self._dict
+        self.silent = False
 
     @property
     def diff(self):
@@ -98,35 +100,43 @@ class PlCoreBase(models.Model):
     def delete(self, *args, **kwds):
         # so we have something to give the observer
         purge = kwds.get('purge',False)
+        silent = kwds.get('silent',False)
         try:
             purge = purge or observer_disabled
         except NameError:
             pass
-            
+
         if (purge):
             del kwds['purge']
             super(PlCoreBase, self).delete(*args, **kwds)
         else:
             self.deleted = True
             self.enacted=None
-            self.save(update_fields=['enacted','deleted'])
-
+            self.save(update_fields=['enacted','deleted'], silent=silent)
 
     def save(self, *args, **kwargs):
+        # let the user specify silence as either a kwarg or an instance varible
+        silent = self.silent
+        if "silent" in kwargs:
+            silent=silent or kwargs.pop("silent")
+
         super(PlCoreBase, self).save(*args, **kwargs)
 
         # This is a no-op if observer_disabled is set
-        notify_observer()
+        if not silent:
+            notify_observer()
 
         self.__initial = self._dict
 
     def save_by_user(self, user, *args, **kwds):
-        if self.can_update(user):
-            self.save(*args, **kwds)
+        if not self.can_update(user):
+            raise PermissionDenied("You do not have permission to update %s objects" % self.__class__.__name__)
+        self.save(*args, **kwds)
 
     def delete_by_user(self, user, *args, **kwds):
-        if self.can_update(user):
-            self.delete(*args, **kwds)
+        if not self.can_update(user):
+            raise PermissionDenied("You do not have permission to delete %s objects" % self.__class__.__name__)
+        self.delete(*args, **kwds)
 
     @property
     def _dict(self):