fix: fix some permissions

apps/fsm/views/fsm_view.py

@@ -46,10 +46,10 @@ class FSMViewSet(CacheEnabledModelViewSet):
     pagination_class = StandardPagination
 
     def get_permissions(self):
-        if self.action in ['partial_update', 'update', 'destroy', 'add_mentor', 'get_states', 'get_edges',
-                           'get_player_from_team', 'players']:
+        if self.action in ['partial_update', 'update', 'destroy', 'add_mentor', 'get_edges', 'get_player_from_team', 'players']:
             permission_classes = [FSMMentorPermission]
-        elif self.action in ['enter', 'review']:
+        # todo: get_states should not be public:
+        elif self.action in ['enter', 'review', 'get_states']:
             permission_classes = [HasActiveRegistration]
         else:
             permission_classes = self.permission_classes
@@ -168,7 +168,7 @@ def players(self, request, pk):
 
     @swagger_auto_schema(responses={200: StateSerializer}, tags=['mentor'])
     @transaction.atomic
-    @action(detail=True, methods=['get'])
+    @action(detail=True, methods=['get'], url_path='states')
     def get_states(self, request, pk):
         return Response(data=StateSerializer(self.get_object().states.order_by('id'), context=self.get_serializer_context(),
                                              many=True).data, status=status.HTTP_200_OK)

apps/fsm/views/program_view.py

@@ -38,8 +38,10 @@ def get_queryset(self):
         return queryset
 
     def get_permissions(self):
-        if self.action in ['retrieve', 'list', 'get_user_permissions', 'get_fsms_user_permissions']:
+        if self.action in ['retrieve', 'list']:
             return [AllowAny()]
+        if self.action in ['get_user_permissions', 'get_user_fsms_status']:
+            return [IsAuthenticated()]
         return [ProgramAdminPermission()]
 
     def get_serializer_class(self):