add special RBAC logic for approve

There is probably a better way, but this should work fine. We rely on route parsing.

backend/core/permissions.py

@@ -35,9 +35,13 @@ def has_object_permission(self, request: Request, view, obj):
         _codename = perms[0].split(".")[1]
         if request.method in ["GET", "OPTIONS", "HEAD"] and obj.is_published:
             return True
+        perm=Permission.objects.get(codename=_codename)
+        # special case of risk acceptance approval
+        if request.parser_context["request"]._request.resolver_match.url_name == "risk-acceptances-accept":
+            perm = Permission.objects.get(codename="approve_riskacceptance")
         return RoleAssignment.is_access_allowed(
             user=request.user,
-            perm=Permission.objects.get(codename=_codename),
+            perm=perm,
             folder=Folder.get_folder(obj),
         )