Merge pull request #656 from openedx/ENT-8871/auth-for-license-provis…

…ioning

[ENT-8871] - Implement Access Control for Provisioning

license_manager/apps/api/permissions.py

@@ -13,3 +13,18 @@ class CanRetireUser(permissions.BasePermission):
 
     def has_permission(self, request, view):
         return request.user.username == settings.RETIREMENT_SERVICE_WORKER_USERNAME or request.user.is_superuser
+
+
+class IsInProvisioningAdminGroup(permissions.BasePermission):
+    """
+    Grant access to those users only who are part of the license provisiioning django group
+    """
+    ALLOWED_API_GROUPS = ['provisioning-admins-group']
+    message = 'Access denied: You do not have the necessary permissions to access this.'
+
+    def has_permission(self, request, view):
+        return (
+            super().has_permission(request, view) and (
+                request.user.groups.filter(name__in=self.ALLOWED_API_GROUPS).exists()
+            )
+        )

license_manager/apps/api/v1/tests/constants.py

@@ -3,6 +3,7 @@
 
 # Constants for subscriptions API tests
 SUBSCRIPTION_RENEWAL_DAYS_OFFSET = 500
+PROVISIONING_ADMINS_GROUP = "provisioning-admins-group"
 
 ADMIN_ROLES = {
     'system_role': constants.SYSTEM_ENTERPRISE_ADMIN_ROLE,