TODO: fix create contract related endpoints

core/apps/contracts/serializers/contracts/contracts.py

@@ -93,7 +93,11 @@ class CreateOwnersForContractSerializer(CreateContractOwnerSerializer):
     
 
 class CreateContractAttachedFileForContractSerializer(CreateContractAttachedFileSerializer):
-    class Meta(CreateContractAttachedFileSerializer.Meta): ...
+    class Meta(CreateContractAttachedFileSerializer.Meta): 
+        read_only_fields = (
+            "contract",
+            *CreateContractAttachedFileSerializer.Meta.read_only_fields
+        )
 
     def create(self, validated_data: dict[str, object]) -> Meta.model:
         contract = self.context.get("contract")

core/apps/contracts/views/contracts.py

@@ -1,7 +1,7 @@
 import uuid
 
 from drf_spectacular.utils import extend_schema
-from rest_framework.permissions import AllowAny, IsAdminUser  # type: ignore
+from rest_framework.permissions import AllowAny, IsAdminUser, IsAuthenticated  # type: ignore
 from rest_framework.viewsets import ModelViewSet  # type: ignore
 from rest_framework.views import APIView  # type: ignore
 
@@ -38,7 +38,7 @@ class ContractView(BaseViewSetMixin, ModelViewSet):
     action_permission_classes = {  # type: ignore
         "list": [IsAdminUser],
         "retrieve": [IsAdminUser],
-        "create": [IsAdminUser],
+        "create": [IsAuthenticated],
         "update": [IsAdminUser],
         "destroy": [IsAdminUser],
         "list_file": [AllowAny],
@@ -54,6 +54,15 @@ class ContractView(BaseViewSetMixin, ModelViewSet):
         "list_owner": RetrieveContractOwnerSerializer,
     }
 
+    def create(
+            self, 
+            request: HttpRequest, 
+            *args: object, 
+            **kwargs: object,
+        ) -> Response:
+        #! TODO: checkout if user has access to create new contract.
+        return super().create(request, *args, **kwargs)  # type: ignore
+
     @extend_schema(
         summary="Get List Of Files",
         description="Get List Of Files"