Return 404 before 403 for order status updates

orders_app/api/permissions.py

@@ -13,16 +13,6 @@ def has_permission(self, request, view):
         ).exists()
 
 
-class IsBusinessUser(BasePermission):
-    """Allow access only to authenticated business users."""
-
-    def has_permission(self, request, view):
-        return UserProfile.objects.filter(
-            user=request.user,
-            type=UserProfile.ProfileType.BUSINESS,
-        ).exists()
-
-
 class IsOrderBusinessOwner(BasePermission):
     """Allow order changes only for the assigned business user."""
 

orders_app/api/test_order_endpoints.py

@@ -342,6 +342,19 @@ def test_order_status_update_unknown_returns_404():
     assert response.status_code == 404
 
 
+@pytest.mark.django_db
+def test_order_status_update_unknown_returns_404_for_non_business_user():
+    customer_user = create_user('customer_user')
+
+    response = authenticated_client(customer_user).patch(
+        reverse('order-detail', kwargs={'pk': 999999}),
+        data={'status': 'completed'},
+        format='json',
+    )
+
+    assert response.status_code == 404
+
+
 @pytest.mark.django_db
 def test_staff_user_can_delete_order():
     customer_user = create_user('customer_user')

orders_app/api/views.py

@@ -7,7 +7,7 @@
 from orders_app.models import Order
 from profiles_app.models import UserProfile
 
-from .permissions import IsBusinessUser, IsCustomerUser, IsOrderBusinessOwner
+from .permissions import IsCustomerUser, IsOrderBusinessOwner
 from .serializers import OrderSerializer
 
 
@@ -31,7 +31,7 @@ def get_permissions(self):
         if self.action == 'create':
             return [IsAuthenticated(), IsCustomerUser()]
         if self.action in ['update', 'partial_update']:
-            return [IsAuthenticated(), IsBusinessUser(), IsOrderBusinessOwner()]
+            return [IsAuthenticated(), IsOrderBusinessOwner()]
         if self.action == 'destroy':
             return [IsAuthenticated(), IsAdminUser()]
         return [IsAuthenticated()]