[search][api] Move from permissions mixin to use permissions

beat/web/search/api.py

@@ -38,7 +38,7 @@ from django.utils import six
 
 from rest_framework.response import Response
 from rest_framework.views import APIView
-from rest_framework import permissions
+from rest_framework import permissions as drf_permissions
 from rest_framework import generics
 from rest_framework import status
 
@@ -49,12 +49,12 @@ from ..experiments.models import Experiment
 from ..toolchains.models import Toolchain
 
 from ..common.models import Shareable
-from ..common.mixins import IsAuthorOrReadOnlyMixin
 from ..common.api import ShareView
 from ..common.utils import ensure_html
 from ..common.responses import BadRequestResponse
 from ..common.mixins import CommonContextMixin, SerializerFieldsMixin
 from ..common.utils import py3_cmp
+from ..common import permissions as beat_permissions
 
 from ..ui.templatetags.gravatar import gravatar_hash
 
@@ -86,7 +86,7 @@ class SearchView(APIView):
 
     """
 
-    permission_classes = [permissions.AllowAny]
+    permission_classes = [drf_permissions.AllowAny]
 
     FILTER_IEXACT = 0
     FILTER_ICONTAINS = 1
@@ -555,7 +555,7 @@ class SearchSaveView(
     """
 
     model = Search
-    permission_classes = [permissions.IsAuthenticated]
+    permission_classes = [drf_permissions.IsAuthenticated]
     serializer_class = SearchWriteSerializer
 
     def build_results(self, request, search):
@@ -599,7 +599,7 @@ class ListSearchView(CommonContextMixin, generics.ListAPIView):
     Lists all available search from a user
     """
 
-    permission_classes = [permissions.AllowAny]
+    permission_classes = [drf_permissions.AllowAny]
     serializer_class = SearchSerializer
 
     def get_queryset(self):
@@ -615,10 +615,7 @@ class ListSearchView(CommonContextMixin, generics.ListAPIView):
 
 
 class RetrieveDestroySearchAPIView(
-    CommonContextMixin,
-    SerializerFieldsMixin,
-    IsAuthorOrReadOnlyMixin,
-    generics.RetrieveDestroyAPIView,
+    CommonContextMixin, SerializerFieldsMixin, generics.RetrieveDestroyAPIView
 ):
     """
     Delete the given search
@@ -626,6 +623,7 @@ class RetrieveDestroySearchAPIView(
 
     model = Search
     serializer_class = SearchSerializer
+    permission_classes = [beat_permissions.IsAuthorOrReadOnly]
 
     def get_object(self):
         author_name = self.kwargs.get("author_name")
@@ -639,6 +637,8 @@ class RetrieveDestroySearchAPIView(
 
     def get(self, request, *args, **kwargs):
         search = self.get_object()
+        self.check_object_permissions(request, search)
+
         # Process the query string
         allow_sharing = request.user == search.author
 
@@ -659,7 +659,7 @@ class ShareSearchView(ShareView):
     """
 
     model = Search
-    permission_classes = [permissions.AllowAny]
+    permission_classes = [drf_permissions.AllowAny]
 
     def get_queryset(self):
         self.kwargs["version"] = 1