<commit_before>from django.conf import settings
from rest_framework.permissions import SAFE_METHODS, BasePermission, DjangoModelPermissions

from course_discovery.apps.course_metadata.models import CourseEditor
from course_discovery.apps.course_metadata.utils import parse_course_key_fragment

USERNAME_REPLACEMENT_GROUP = "username_replacement_admin"


class ReadOnlyByPublisherUser(BasePermission):
    """
    Custom Permission class to check user is a publisher user.
    """
    def has_permission(self, request, view):
        if request.method == 'GET':
            return request.user.groups.exists()
        return True


class IsCourseEditorOrReadOnly(BasePermission):
    """
    Custom Permission class to check user is a course editor for the course, if they are trying to write.
    """
    def has_permission(self, request, view):
        if request.method == 'POST':
            org = request.data.get('org')
            return org and CourseEditor.can_create_course(request.user, org)
        else:
            return True  # other write access attempts will be caught by object permissions below

    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True
        else:
            return CourseEditor.is_course_editable(request.user, obj)


class IsCourseRunEditorOrDjangoOrReadOnly(BasePermission):
    """
    Custom Permission class to check user is a course editor for the course or has django model access
    """
    def __init__(self):
        self.django_perms = DjangoModelPermissions()

    def has_permission(self, request, view):
        if self.django_perms.has_permission(request, view):
            return True
        elif request.user.is_staff:
            return True
        elif request.method == 'POST':
            course = request.data.get('course')
            if not course:
                return False
            org, _ = parse_course_key_fragment(course)
            return org and CourseEditor.can_create_course(request.user, org)
        else:
            return True  # other write access attempts will be caught by object permissions below

    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True
        else:
            return CourseEditor.is_course_editable(request.user, obj.course)


class CanReplaceUsername(BasePermission):
    """<commit_msg>Be more permissive when receving OPTIONS requests<commit_after>from django.conf import settings
from rest_framework.permissions import SAFE_METHODS, BasePermission, DjangoModelPermissions

from course_discovery.apps.course_metadata.models import CourseEditor
from course_discovery.apps.course_metadata.utils import parse_course_key_fragment

USERNAME_REPLACEMENT_GROUP = "username_replacement_admin"


class ReadOnlyByPublisherUser(BasePermission):
    """
    Custom Permission class to check user is a publisher user.
    """
    def has_permission(self, request, view):
        if request.method == 'GET':
            return request.user.groups.exists()
        return True


class IsCourseEditorOrReadOnly(BasePermission):
    """
    Custom Permission class to check user is a course editor for the course, if they are trying to write.
    """
    def has_permission(self, request, view):
        if request.method == 'POST':
            org = request.data.get('org')
            if not org:
                # Fail happily because OPTIONS goes down this path too with a fake POST.
                # If this is a real POST, we'll complain about the missing org in the view.
                return True
            return CourseEditor.can_create_course(request.user, org)
        else:
            return True  # other write access attempts will be caught by object permissions below

    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True
        else:
            return CourseEditor.is_course_editable(request.user, obj)


class IsCourseRunEditorOrDjangoOrReadOnly(BasePermission):
    """
    Custom Permission class to check user is a course editor for the course or has django model access
    """
    def __init__(self):
        self.django_perms = DjangoModelPermissions()

    def has_permission(self, request, view):
        if self.django_perms.has_permission(request, view):
            return True
        elif request.user.is_staff:
            return True
        elif request.method == 'POST':
            course = request.data.get('course')
            if not course:
                # Fail happily because OPTIONS goes down this path too with a fake POST.
                # If this is a real POST, we'll complain about the missing course in the view.
                return True
            org, _ = parse_course_key_fragment(course)
            return org and CourseEditor.can_create_course(request.user, org)
        else:
            return True  # other write access attempts will be caught by object permissions below

    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True
        else:
            return CourseEditor.is_course_editable(request.user, obj.course)


class CanReplaceUsername(BasePermission):
    """
{'fraction_non_alphanumeric': 0.06565086531226486, 'fraction_numerical': 0.0, 'mean_word_length': 2.7602545968882604, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1445406', 'n_tokens_mistral': 1369, 'n_tokens_neox': 1331, 'n_words': 449}