Make GET active shift API call protected

KiOui · Oct 23, 2024 · 8d6e49d · 8d6e49d
1 parent adee2f9
commit 8d6e49d
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/website/orders/api/v1/views.py b/website/orders/api/v1/views.py
@@ -306,6 +306,10 @@ class OrderVenueActiveShiftAPIView(APIView):
     """API View to retrieve the active shift."""
 
     serializer_class = ShiftSerializer
+    permission_classes = [IsAuthenticatedOrTokenHasScopeForMethod]
+    required_scopes_for_method = {
+        "GET": ["orders:order"]
+    }
 
     def get(self, request, **kwargs):
         """Get the active shift of an order venue if there is one, otherwise return 404."""