feat: implement API security measures phase 1

api/accounts/permissions.py

@@ -0,0 +1,33 @@
+from rest_framework.permissions import SAFE_METHODS, BasePermission
+
+
+class IsAdminOrReadOnly(BasePermission):
+    """Admin users can perform any action; others can only read."""
+
+    def has_permission(self, request, view):
+        if not request.user or not request.user.is_authenticated:
+            return False
+        if request.method in SAFE_METHODS:
+            return True
+        return request.user.is_admin
+
+    def has_object_permission(self, request, view, obj):
+        if request.method in SAFE_METHODS:
+            return True
+        return request.user.is_admin
+
+
+class IsOwnerOrAdmin(BasePermission):
+    """Users can only access their own resources; admins can access all."""
+
+    def has_permission(self, request, view):
+        return bool(request.user and request.user.is_authenticated)
+
+    def has_object_permission(self, request, view, obj):
+        if request.user.is_admin:
+            return True
+        # Expect obj to have a `user` FK pointing to the owning user
+        user_field = getattr(obj, "user", None)
+        if user_field is not None:
+            return user_field == request.user
+        return False