✨ GIS API: verify read-only permission

1 files changed, 5 insertions, 0 deletions

diff --git a/ishtar_common/views_api.py b/ishtar_common/views_api.py
index e0226811b..71bf921da 100644
--- a/ishtar_common/views_api.py
+++ b/ishtar_common/views_api.py
@@ -65,6 +65,8 @@ class GISSourceAPI(GISAPIView):
 
     def get(self, request, format=None):
         serializer = ImporterTypeSerializer(self.get_queryset(), many=True)
+        for source in serializer.data:
+            source["access_type"] = request.auth.access_type
         return Response(serializer.data)
 
 
@@ -143,6 +145,9 @@ class GISImportAPI(GISBaseImportView, GISAPIView):
         if not importer:
             return Response({"error": "Importer not found"},
                             status=status.HTTP_400_BAD_REQUEST)
+        if request.auth.access_type != "W":
+            return Response({"error": "No write permission"},
+                            status=status.HTTP_403_FORBIDDEN)
         data = {}
         for k in request.data:
             data[k] = request.data.get(k)