feat: use Django model permissions for Note, RRule, Schedule and Timeslot

program/views.py

@@ -418,6 +418,7 @@ class APIShowViewSet(DisabledObjectPermissionCheckMixin, viewsets.ModelViewSet):
     list=extend_schema(summary="List all rrule."),
 )
 class APIRRuleViewSet(viewsets.ModelViewSet):
+    permission_classes = [permissions.DjangoModelPermissionsOrAnonReadOnly]
     queryset = RRule.objects.all()
     serializer_class = RRuleSerializer
 
@@ -513,10 +514,11 @@ class APIScheduleViewSet(
         "show_pk": "show",
     }
 
+    filterset_class = filters.ScheduleFilterSet
+    pagination_class = LimitOffsetPagination
+    permission_classes = [permissions.DjangoModelPermissionsOrAnonReadOnly]
     queryset = Schedule.objects.all()
     serializer_class = ScheduleSerializer
-    pagination_class = LimitOffsetPagination
-    filterset_class = filters.ScheduleFilterSet
 
     def get_serializer_class(self):
         if self.action in ("create", "update", "partial_update"):
@@ -645,10 +647,11 @@ class APITimeSlotViewSet(
         "schedule_pk": "schedule",
     }
 
-    serializer_class = TimeSlotSerializer
+    filterset_class = filters.TimeSlotFilterSet
     pagination_class = LimitOffsetPagination
+    permission_classes = [permissions.DjangoModelPermissionsOrAnonReadOnly]
     queryset = TimeSlot.objects.all().order_by("-start")
-    filterset_class = filters.TimeSlotFilterSet
+    serializer_class = TimeSlotSerializer
 
     def update(self, request, *args, **kwargs):
         show_pk = get_values(self.kwargs, "show_pk")
@@ -692,10 +695,12 @@ class APINoteViewSet(
         "show_pk": "timeslot__show",
         "timeslot_pk": "timeslot",
     }
+
+    filterset_class = filters.NoteFilterSet
+    pagination_class = LimitOffsetPagination
+    permission_classes = [permissions.DjangoModelPermissionsOrAnonReadOnly]
     queryset = Note.objects.all()
     serializer_class = NoteSerializer
-    pagination_class = LimitOffsetPagination
-    filterset_class = filters.NoteFilterSet
 
     def get_serializer_context(self):
         # the serializer needs the request in the context