docmanager_backend/accounts/permissions.py

@@ -19,7 +19,7 @@ class IsPlanning(BasePermission):
     """
 
     def has_permission(self, request, view):
-        return bool(request.user and request.user.role in ("planning", "admin", "head", "staff"))
+        return bool(request.user and request.user.role in ("planning", "admin"))
 
 
 class IsHead(BasePermission):

docmanager_backend/questionnaires/views.py

@@ -15,14 +15,7 @@ class QuestionnaireListAPIView(generics.ListAPIView):
     serializer_class = QuestionnaireSerializer
     queryset = Questionnaire.objects.all()
     pagination_class = PageNumberPagination
-    permission_classes = [IsAuthenticated]
-
-    def get_queryset(self):
-        user = self.request.user
-        if user.role == "client":
-            return Questionnaire.objects.filter(client=user)
-        else:
-            return Questionnaire.objects.all()
+    permission_classes = [IsAuthenticated, IsPlanning]
 
 
 class QuestionnaireSubmitView(generics.CreateAPIView):