SCKAN-323 feat: Change permission to allow creation of entities

backend/composer/api/permissions.py

@@ -10,7 +10,7 @@ def has_object_permission(self, request, view, obj):
         return True
 
 
-class IsOwnerOrAssignOwnerOrReadOnly(permissions.BasePermission):
+class IsOwnerOrAssignOwnerOrCreateOrReadOnly(permissions.BasePermission):
     """
     Custom permission to allow only the owner to edit an object,
     but allow any authenticated user to assign themselves as owner,
@@ -29,6 +29,13 @@ def has_object_permission(self, request, view, obj):
         # Write permissions are only allowed to the owner
         return obj.owner == request.user
 
+    def has_permission(self, request, view):
+        # Allow authenticated users to create new objects (POST requests)
+        if request.method == 'POST':
+            return request.user.is_authenticated
+
+        # Allow access for non-object-specific safe methods (e.g., listing objects via GET)
+        return request.method in permissions.SAFE_METHODS
 
 class IsOwnerOfConnectivityStatementOrReadOnly(permissions.BasePermission):
     """

backend/composer/api/views.py

@@ -40,7 +40,7 @@
     ProvenanceSerializer,
     SexSerializer, ConnectivityStatementUpdateSerializer, DestinationSerializer, BaseConnectivityStatementSerializer,
 )
-from .permissions import IsStaffUserIfExportedStateInConnectivityStatement, IsOwnerOrAssignOwnerOrReadOnly, \
+from .permissions import IsStaffUserIfExportedStateInConnectivityStatement, IsOwnerOrAssignOwnerOrCreateOrReadOnly, \
     IsOwnerOfConnectivityStatementOrReadOnly
 from ..models import (
     AnatomicalEntity,
@@ -324,7 +324,7 @@ class ConnectivityStatementViewSet(
     serializer_class = ConnectivityStatementSerializer
     permission_classes = [
         IsStaffUserIfExportedStateInConnectivityStatement,
-        IsOwnerOrAssignOwnerOrReadOnly,
+        IsOwnerOrAssignOwnerOrCreateOrReadOnly,
     ]
     filterset_class = ConnectivityStatementFilter
     service = ConnectivityStatementStateService
@@ -440,7 +440,7 @@ class SentenceViewSet(
     queryset = Sentence.objects.all()
     serializer_class = SentenceSerializer
     permission_classes = [
-        IsOwnerOrAssignOwnerOrReadOnly,
+        IsOwnerOrAssignOwnerOrCreateOrReadOnly,
     ]
     filterset_class = SentenceFilter
     service = SentenceStateService