diff --git a/api/utils/serializer/serializer.py b/api/utils/serializer/serializer.py index c8e9083..3820b30 100644 --- a/api/utils/serializer/serializer.py +++ b/api/utils/serializer/serializer.py @@ -133,4 +133,19 @@ class AbstractModelAPISerializer: return self.model.objects.get( id=id, users__in=[user] - ) \ No newline at end of file + ) + + @abstractmethod + def initialize_objects(self, json_model, user): + """ Initializes all needed objects from the json_model data + + Does not persist data to the DB! + + Args: + json_model (dict): The json data + user (User): The API user + + Returns: + obj (Intervention) + """ + raise NotImplementedError("Must be implemented in subclasses") diff --git a/api/utils/serializer/v1/compensation.py b/api/utils/serializer/v1/compensation.py index d06807e..3cc2261 100644 --- a/api/utils/serializer/v1/compensation.py +++ b/api/utils/serializer/v1/compensation.py @@ -81,8 +81,10 @@ class CompensationAPISerializerV1(AbstractModelAPISerializerV1): """ intervention = Intervention.objects.get( id=intervention_id, - users__in=[user], ) + is_shared = intervention.is_shared_with(user) + if not is_shared: + raise PermissionError("Intervention not shared with user") obj.intervention = intervention return obj