fix admin user persm

api/permissions.py

@@ -1,6 +1,44 @@
 from rest_framework import permissions
 
 
+def user_is_admin(user) -> bool:
+    """Single source of truth for "is this user an administrator?".
+
+    Any of the three flags grants admin access: the app-specific ``is_admin``
+    flag, Django's ``is_staff``, or ``is_superuser``. Both the permission
+    classes and the per-view authorization checks use this so the three flags
+    behave identically everywhere.
+    """
+    return bool(
+        user
+        and user.is_authenticated
+        and (
+            getattr(user, "is_admin", False)
+            or getattr(user, "is_staff", False)
+            or getattr(user, "is_superuser", False)
+        )
+    )
+
+
+class IsAdminOrStaffPermission(permissions.BasePermission):
+    """Admin gate for admin-only endpoints and for views that have no
+    model/queryset of their own (e.g. proxy endpoints).
+
+    ``IsStaffEditorPermission`` can't be used on model-less views because it
+    derives the required permission from ``view.queryset.model`` (``None``
+    there); it also requires granular Django model permissions that admin
+    accounts are not necessarily granted. This gate keys off admin status
+    instead.
+    """
+
+    message = {
+        "message": "You do not have permission to perform this action.",
+    }
+
+    def has_permission(self, request, view):
+        return user_is_admin(request.user)
+
+
 class IsStaffEditorPermission(permissions.DjangoModelPermissions):
     perms_map = {
         "GET": ["%(app_label)s.view_%(model_name)s"],