Fixes: AddressViewSet

core/filters.py

@@ -17,7 +17,7 @@ from django_filters import (
     UUIDFilter,
 )
 
-from core.models import Brand, Category, Feedback, Order, Product, Wishlist
+from core.models import Address, Brand, Category, Feedback, Order, Product, Wishlist
 
 logger = logging.getLogger(__name__)
 
@@ -372,3 +372,24 @@ class FeedbackFilter(FilterSet):
     class Meta:
         model = Feedback
         fields = ["uuid", "product_uuid", "user_uuid", "order_by"]
+
+
+class AddressFilter(FilterSet):
+    uuid = UUIDFilter(field_name="uuid", lookup_expr="exact", label=_("UUID"))
+    user_uuid = UUIDFilter(field_name="user__uuid", lookup_expr="exact", label=_("User UUID"))
+    user_email = CharFilter(field_name="user__email", lookup_expr="iexact", label=_("User email"))
+
+    order_by = OrderingFilter(
+        fields=(
+            ("uuid", "uuid"),
+            ("user__email", "user_email"),
+            ("user__uuid", "user_uuid"),
+            ("created", "created"),
+            ("modified", "modified"),
+            ("?", "random"),
+        )
+    )
+
+    class Meta:
+        model = Address
+        fields = ["uuid", "user_uuid", "user_email", "order_by"]

core/permissions.py

@@ -96,7 +96,7 @@ class EvibesPermission(permissions.BasePermission):
                 return queryset.none()
 
             base = queryset.filter(is_active=True, user=request.user)
-            if request.user.is_staff and request.user.has_perm(
+            if request.user.has_perm(
                     f"{app_label}.{self.ACTION_PERM_MAP.get(view.action)}_{model_name}"
             ):
                 return queryset.filter(is_active=True)

core/viewsets.py

@@ -32,7 +32,7 @@ from core.docs.drf.viewsets import (
     PRODUCT_SCHEMA,
     WISHLIST_SCHEMA,
 )
-from core.filters import BrandFilter, CategoryFilter, FeedbackFilter, OrderFilter, ProductFilter
+from core.filters import AddressFilter, BrandFilter, CategoryFilter, FeedbackFilter, OrderFilter, ProductFilter
 from core.models import (
     Address,
     Attribute,
@@ -633,6 +633,8 @@ class WishlistViewSet(EvibesViewSet):
 @extend_schema_view(**ADDRESS_SCHEMA)
 class AddressViewSet(EvibesViewSet):
     pagination_class = None
+    filter_backends = [DjangoFilterBackend]
+    filterset_class = AddressFilter
     queryset = Address.objects.all()
     serializer_class = AddressSerializer
     additional = {"create": "ALLOW"}
@@ -644,6 +646,15 @@ class AddressViewSet(EvibesViewSet):
             return AddressAutocompleteInputSerializer
         return AddressSerializer
 
+    def get_queryset(self):
+        if self.request.user.has_perm("core.view_address"):
+            return super().get_queryset()
+
+        if self.request.user.is_authenticated:
+            return super().get_queryset().filter(user=self.request.user)
+
+        return Adress.objects.none()
+
     def create(self, request, **kwargs):
         create_serializer = AddressCreateSerializer(data=request.data, context={"request": request})
         create_serializer.is_valid(raise_exception=True)