From fd97d8a072a93f7a1a7f5fbd119044837af3e75d Mon Sep 17 00:00:00 2001
From: Egor fureunoir Gorbunov <contact@fureunoir.com>
Date: Thu, 12 Jun 2025 09:18:20 +0300
Subject: [PATCH] Fixes: AddressViewSet

---
 core/filters.py     | 23 ++++++++++++++++++++++-
 core/permissions.py |  2 +-
 core/viewsets.py    | 13 ++++++++++++-
 3 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/core/filters.py b/core/filters.py
index a1471f40..286a6160 100644
--- a/core/filters.py
+++ b/core/filters.py
@@ -17,7 +17,7 @@ from django_filters import (
     UUIDFilter,
 )
 
-from core.models import Brand, Category, Feedback, Order, Product, Wishlist
+from core.models import Address, Brand, Category, Feedback, Order, Product, Wishlist
 
 logger = logging.getLogger(__name__)
 
@@ -372,3 +372,24 @@ class FeedbackFilter(FilterSet):
     class Meta:
         model = Feedback
         fields = ["uuid", "product_uuid", "user_uuid", "order_by"]
+
+
+class AddressFilter(FilterSet):
+    uuid = UUIDFilter(field_name="uuid", lookup_expr="exact", label=_("UUID"))
+    user_uuid = UUIDFilter(field_name="user__uuid", lookup_expr="exact", label=_("User UUID"))
+    user_email = CharFilter(field_name="user__email", lookup_expr="iexact", label=_("User email"))
+
+    order_by = OrderingFilter(
+        fields=(
+            ("uuid", "uuid"),
+            ("user__email", "user_email"),
+            ("user__uuid", "user_uuid"),
+            ("created", "created"),
+            ("modified", "modified"),
+            ("?", "random"),
+        )
+    )
+
+    class Meta:
+        model = Address
+        fields = ["uuid", "user_uuid", "user_email", "order_by"]
diff --git a/core/permissions.py b/core/permissions.py
index 3553fdf4..3a941e60 100644
--- a/core/permissions.py
+++ b/core/permissions.py
@@ -96,7 +96,7 @@ class EvibesPermission(permissions.BasePermission):
                 return queryset.none()
 
             base = queryset.filter(is_active=True, user=request.user)
-            if request.user.is_staff and request.user.has_perm(
+            if request.user.has_perm(
                     f"{app_label}.{self.ACTION_PERM_MAP.get(view.action)}_{model_name}"
             ):
                 return queryset.filter(is_active=True)
diff --git a/core/viewsets.py b/core/viewsets.py
index 44f93d2a..219ce3a4 100644
--- a/core/viewsets.py
+++ b/core/viewsets.py
@@ -32,7 +32,7 @@ from core.docs.drf.viewsets import (
     PRODUCT_SCHEMA,
     WISHLIST_SCHEMA,
 )
-from core.filters import BrandFilter, CategoryFilter, FeedbackFilter, OrderFilter, ProductFilter
+from core.filters import AddressFilter, BrandFilter, CategoryFilter, FeedbackFilter, OrderFilter, ProductFilter
 from core.models import (
     Address,
     Attribute,
@@ -633,6 +633,8 @@ class WishlistViewSet(EvibesViewSet):
 @extend_schema_view(**ADDRESS_SCHEMA)
 class AddressViewSet(EvibesViewSet):
     pagination_class = None
+    filter_backends = [DjangoFilterBackend]
+    filterset_class = AddressFilter
     queryset = Address.objects.all()
     serializer_class = AddressSerializer
     additional = {"create": "ALLOW"}
@@ -644,6 +646,15 @@ class AddressViewSet(EvibesViewSet):
             return AddressAutocompleteInputSerializer
         return AddressSerializer
 
+    def get_queryset(self):
+        if self.request.user.has_perm("core.view_address"):
+            return super().get_queryset()
+
+        if self.request.user.is_authenticated:
+            return super().get_queryset().filter(user=self.request.user)
+
+        return Adress.objects.none()
+
     def create(self, request, **kwargs):
         create_serializer = AddressCreateSerializer(data=request.data, context={"request": request})
         create_serializer.is_valid(raise_exception=True)