diff --git a/logify-backend/apps/accounts/views.py b/logify-backend/apps/accounts/views.py index 1cfd451..3960b68 100644 --- a/logify-backend/apps/accounts/views.py +++ b/logify-backend/apps/accounts/views.py @@ -259,6 +259,25 @@ def get_object(self, pk): return target raise PermissionDenied("You can only view your assigned supervisors.") + if requester.role == User.WORKPLACE_SUPERVISOR: + is_assigned = ( + InternshipPlacements.objects.filter(workplace_supervisor=requester) + .filter(intern=target) + .exists() + ) + if is_assigned: + return target + raise PermissionDenied("You can only view interns assigned to you.") + + if requester.role == User.ACADEMIC_SUPERVISOR: + is_assigned = ( + InternshipPlacements.objects.filter(academic_supervisor=requester) + .filter(intern=target) + .exists() + ) + if is_assigned: + return target + raise PermissionDenied("You can only view interns assigned to you.") if requester.role == User.ACADEMIC_SUPERVISOR: if target.role == User.STUDENT: if InternshipPlacements.objects.filter(