Implement permission checking for delete and patch mutations

aleksis/core/schema/base.py

@@ -82,9 +82,11 @@ class PermissionBatchPatchMixin:
         login_required = True
 
     @classmethod
-    def check_permissions(cls, root, info, input): # noqa
-        # TODO: Check PERMISSIONS (or rules)
-        return True
+    def check_permissions(cls, root, info, input):
+        if info.context.user.has_perms(cls._meta.permissions, root):
+            return
+
+        raise PermissionDenied()
 
 
 class PermissionBatchDeleteMixin:
@@ -92,9 +94,11 @@ class PermissionBatchDeleteMixin:
         login_required = True
 
     @classmethod
-    def check_permissions(cls, root, info, input): # noqa
-        # TODO: Check PERMISSIONS (or rules)
-        return True
+    def check_permissions(cls, root, info, input):
+        if info.context.user.has_perms(cls._meta.permissions, root):
+            return
+
+        raise PermissionDenied()
 
 
 class PermissionPatchMixin:
@@ -102,9 +106,11 @@ class PermissionPatchMixin:
         login_required = True
 
     @classmethod
-    def check_permissions(cls, root, info, input, id, obj): # noqa
-        # TODO: Check PERMISSIONS (or rules)
-        return True
+    def check_permissions(cls, root, info, input, id, obj):
+        if info.context.user.has_perms(cls._meta.permissions, root):
+            return
+
+        raise PermissionDenied()
 
 
 class DjangoFilterMixin: