<s> from rest_framework import generics <EOL> from rest_framework import permissions as drf_permissions <EOL> from rest_framework . exceptions import NotAuthenticated <EOL> from django . contrib . auth . models import AnonymousUser <EOL> from modularodm import Q <EOL> from framework . auth . oauth_scopes import CoreScopes <EOL> from website . models import User , Node <EOL> from api . base import permissions as base_permissions <EOL> from api . base . utils import get_object_or_error <EOL> from api . base . exceptions import Conflict <EOL> from api . base . views import JSONAPIBaseView <EOL> from api . base . filters import ODMFilterMixin <EOL> from api . base . parsers import JSONAPIRelationshipParser , JSONAPIRelationshipParserForRegularJSON <EOL> from api . nodes . serializers import NodeSerializer <EOL> from api . institutions . serializers import InstitutionSerializer <EOL> from api . registrations . serializers import RegistrationSerializer <EOL> from api . base . utils import default_node_list_query , default_node_permission_query <EOL> from . serializers import UserSerializer , UserDetailSerializer , UserInstitutionsRelationshipSerializer <EOL> from . permissions import ReadOnlyOrCurrentUser , ReadOnlyOrCurrentUserRelationship <EOL> class UserMixin ( object ) : <EOL> """<STR_LIT>""" <EOL> serializer_class = UserSerializer <EOL> user_lookup_url_kwarg = '<STR_LIT>' <EOL> def get_user ( self , check_permissions = True ) : <EOL> key = self . kwargs [ self . user_lookup_url_kwarg ] <EOL> current_user = self . request . user <EOL> if key == '<STR_LIT>' : <EOL> if isinstance ( current_user , AnonymousUser ) : <EOL> raise NotAuthenticated <EOL> else : <EOL> return self . request . user <EOL> obj = get_object_or_error ( User , key , '<STR_LIT:user>' ) <EOL> if check_permissions : <EOL> self . check_object_permissions ( self . request , obj ) <EOL> return obj <EOL> class UserList ( JSONAPIBaseView , generics . ListAPIView , ODMFilterMixin ) : <EOL> """<STR_LIT>""" <EOL> permission_classes = ( <EOL> drf_permissions . IsAuthenticatedOrReadOnly , <EOL> base_permissions . TokenHasScope , <EOL> ) <EOL> required_read_scopes = [ CoreScopes . USERS_READ ] <EOL> required_write_scopes = [ CoreScopes . USERS_WRITE ] <EOL> serializer_class = UserSerializer <EOL> ordering = ( '<STR_LIT>' ) <EOL> view_category = '<STR_LIT>' <EOL> view_name = '<STR_LIT>' <EOL> def get_default_odm_query ( self ) : <EOL> return ( <EOL> Q ( '<STR_LIT>' , '<STR_LIT>' , True ) & <EOL> Q ( '<STR_LIT>' , '<STR_LIT>' , True ) & <EOL> Q ( '<STR_LIT>' , '<STR_LIT>' , None ) <EOL> ) <EOL> def get_queryset ( self ) : <EOL> query = self . get_query_from_request ( ) <EOL> return User . find ( query ) <EOL> class UserDetail ( JSONAPIBaseView , generics . RetrieveUpdateAPIView , UserMixin ) : <EOL> """<STR_LIT>""" <EOL> permission_classes = ( <EOL> drf_permissions . IsAuthenticatedOrReadOnly , <EOL> ReadOnlyOrCurrentUser , <EOL> base_permissions . TokenHasScope , <EOL> ) <EOL> required_read_scopes = [ CoreScopes . USERS_READ ] <EOL> required_write_scopes = [ CoreScopes . USERS_WRITE ] <EOL> view_category = '<STR_LIT>' <EOL> view_name = '<STR_LIT>' <EOL> serializer_class = UserDetailSerializer <EOL> def get_object ( self ) : <EOL> return self . get_user ( ) <EOL> def get_serializer_context ( self ) : <EOL> context = JSONAPIBaseView . get_serializer_context ( self ) <EOL> context [ '<STR_LIT>' ] = self . request <EOL> return context <EOL> class UserNodes ( JSONAPIBaseView , generics . ListAPIView , UserMixin , ODMFilterMixin ) : <EOL> """<STR_LIT>""" <EOL> permission_classes = ( <EOL> drf_permissions . IsAuthenticatedOrReadOnly , <EOL> base_permissions . TokenHasScope , <EOL> ) <EOL> required_read_scopes = [ CoreScopes . USERS_READ , CoreScopes . NODE_BASE_READ ] <EOL> required_write_scopes = [ CoreScopes . USERS_WRITE , CoreScopes . NODE_BASE_WRITE ] <EOL> serializer_class = NodeSerializer <EOL> view_category = '<STR_LIT>' <EOL> view_name = '<STR_LIT>' <EOL> ordering = ( '<STR_LIT>' , ) <EOL> def get_default_odm_query ( self ) : <EOL> user = self . get_user ( ) <EOL> query = Q ( '<STR_LIT>' , '<STR_LIT>' , user ) & default_node_list_query ( ) <EOL> if user != self . request . user : <EOL> query &= default_node_permission_query ( self . request . user ) <EOL> return query <EOL> def get_queryset ( self ) : <EOL> return Node . find ( self . get_query_from_request ( ) ) <EOL> class UserInstitutions ( JSONAPIBaseView , generics . ListAPIView , UserMixin ) : <EOL> permission_classes = ( <EOL> drf_permissions . IsAuthenticatedOrReadOnly , <EOL> base_permissions . TokenHasScope , <EOL> ) <EOL> required_read_scopes = [ CoreScopes . USERS_READ , CoreScopes . INSTITUTION_READ ] <EOL> required_write_scopes = [ CoreScopes . NULL ] <EOL> serializer_class = InstitutionSerializer <EOL> view_category = '<STR_LIT>' <EOL> view_name = '<STR_LIT>' <EOL> def get_default_odm_query ( self ) : <EOL> return None <EOL> def get_queryset ( self ) : <EOL> user = self . get_user ( ) <EOL> return user . affiliated_institutions <EOL> class UserRegistrations ( UserNodes ) : <EOL> """<STR_LIT>""" <EOL> required_read_scopes = [ CoreScopes . USERS_READ , CoreScopes . NODE_REGISTRATIONS_READ ] <EOL> required_write_scopes = [ CoreScopes . USERS_WRITE , CoreScopes . NODE_REGISTRATIONS_WRITE ] <EOL> serializer_class = RegistrationSerializer <EOL> view_category = '<STR_LIT>' <EOL> view_name = '<STR_LIT>' <EOL> def get_default_odm_query ( self ) : <EOL> user = self . get_user ( ) <EOL> current_user = self . request . user <EOL> query = ( <EOL> Q ( '<STR_LIT>' , '<STR_LIT>' , True ) & <EOL> Q ( '<STR_LIT>' , '<STR_LIT>' , True ) & <EOL> Q ( '<STR_LIT>' , '<STR_LIT>' , True ) & <EOL> Q ( '<STR_LIT>' , '<STR_LIT>' , user . _id ) <EOL> ) <EOL> permission_query = Q ( '<STR_LIT>' , '<STR_LIT>' , True ) <EOL> if not current_user . is_anonymous ( ) : <EOL> permission_query = ( permission_query | Q ( '<STR_LIT>' , '<STR_LIT>' , current_user . _id ) ) <EOL> query = query & permission_query <EOL> return query <EOL> class UserInstitutionsRelationship ( JSONAPIBaseView , generics . RetrieveDestroyAPIView , UserMixin ) : <EOL> permission_classes = ( <EOL> drf_permissions . IsAuthenticatedOrReadOnly , <EOL> base_permissions . TokenHasScope , <EOL> ReadOnlyOrCurrentUserRelationship <EOL> ) <EOL> required_read_scopes = [ CoreScopes . USERS_READ ] <EOL> required_write_scopes = [ CoreScopes . USERS_WRITE ] <EOL> serializer_class = UserInstitutionsRelationshipSerializer <EOL> parser_classes = ( JSONAPIRelationshipParser , JSONAPIRelationshipParserForRegularJSON , ) <EOL> view_category = '<STR_LIT>' <EOL> view_name = '<STR_LIT>' <EOL> def get_object ( self ) : <EOL> user = self . get_user ( check_permissions = False ) <EOL> obj = { <EOL> '<STR_LIT:data>' : user . affiliated_institutions , <EOL> '<STR_LIT>' : user <EOL> } <EOL> self . check_object_permissions ( self . request , obj ) <EOL> return obj <EOL> def perform_destroy ( self , instance ) : <EOL> data = self . request . data [ '<STR_LIT:data>' ] <EOL> user = self . request . user <EOL> current_institutions = { inst . _id for inst in user . affiliated_institutions } <EOL> for val in data : <EOL> if val [ '<STR_LIT:type>' ] != self . serializer_class . Meta . type_ : <EOL> raise Conflict ( ) <EOL> for val in data : <EOL> if val [ '<STR_LIT:id>' ] in current_institutions : <EOL> user . remove_institution ( val [ '<STR_LIT:id>' ] ) <EOL> user . save ( ) </s>
