Respond to CR by changing permissions logic and removing vestigial `u…

…ser` field

api/users/permissions.py

@@ -64,9 +64,6 @@ def has_permission(self, request, view) -> bool:
         Returns:
             bool: True if the user has the required permission, False otherwise.
         """
-        if request.method != 'POST':
-            return False
-
         user = request.user
         if not user or user.is_anonymous:
             return False
@@ -93,7 +90,7 @@ def _validate_institutional_request(self, request, user: OSFUser) -> bool:
         institution = self._get_institution(institution_id)
 
         if not user.is_institutional_admin(institution):
-            raise exceptions.NotAuthenticated('You are not an admin of the specified institution.')
+            raise exceptions.PermissionDenied('You are not an admin of the specified institution.')
 
         return True
 

api/users/serializers.py

@@ -694,12 +694,7 @@ class UserMessageSerializer(JSONAPISerializer):
     institution = RelationshipField(
         related_view='institutions:institution-detail',
         related_view_kwargs={'institution_id': '<institution._id>'},
-        help_text='The institution associated with this message. This field is required.',
-    )
-    user = RelationshipField(
-        related_view='users:user-detail',
-        related_view_kwargs={'user_id': '<recipient._id>'},
-        help_text='The recipient of the message.',
+        help_text='The institution associated with this message.',
     )
 
     def get_absolute_url(self, obj: UserMessage) -> str:
@@ -718,7 +713,7 @@ def to_internal_value(self, data):
         return data
 
     class Meta:
-        type_ = 'user-message'
+        type_ = 'user-messages'
 
     def create(self, validated_data: Dict[str, Any]) -> UserMessage:
         """