From d1a87fa90aab7689aa3e29f078e1150a50f6dadb Mon Sep 17 00:00:00 2001
From: sandronadiradze <sandro.nadiradze@makingscience.com>
Date: Tue, 5 Nov 2024 14:15:13 +0400
Subject: [PATCH] chore: add permission to declare winner view so that if it
 has a winner winner declaration is prohibited.

---
 auction/permissions.py | 15 +++++++++++++++
 auction/views.py       |  9 ++++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/auction/permissions.py b/auction/permissions.py
index a8e0e62..849a188 100644
--- a/auction/permissions.py
+++ b/auction/permissions.py
@@ -1,5 +1,7 @@
 from rest_framework.permissions import BasePermission
 
+from auction.models.auction import AuctionStatistics
+
 
 class IsOwner(BasePermission):
     """
@@ -71,3 +73,16 @@ def has_permission(self, request, view):
 
     def has_object_permission(self, request, view, obj):
         return str(obj.auction.author) == str(request.user.id)
+
+
+class AlreadyHasAWinner(BasePermission):
+    def has_permission(self, request, view):
+        return True
+
+    def has_object_permission(self, request, view, obj):
+        auction_statistics = AuctionStatistics.objects.filter(auction=obj).first()
+
+        if auction_statistics:
+            return auction_statistics.winner_bid_object is not None
+
+        return False
diff --git a/auction/views.py b/auction/views.py
index d4f0c0a..8924adb 100755
--- a/auction/views.py
+++ b/auction/views.py
@@ -51,6 +51,7 @@
     seller_dashboard_list_openapi_examples,
 )
 from auction.permissions import (
+    AlreadyHasAWinner,
     HasCountryInProfile,
     IsAuctionOwner,
     IsBookmarkOwner,
@@ -1095,7 +1096,13 @@ class DeclareWinnerView(generics.GenericAPIView):
     and the bid status will be set to `APPROVED`.
     """
 
-    permission_classes = [IsAuthenticated, IsBuyer, IsAuctionOwner, HasCountryInProfile]
+    permission_classes = [
+        IsAuthenticated,
+        IsBuyer,
+        IsAuctionOwner,
+        HasCountryInProfile,
+        AlreadyHasAWinner,
+    ]
 
     def get_bid(self, auction_id, bid_id):
         bid = get_object_or_404(