UUID, email fields and receiver for sending them, /edit API for modifying signup with ID and UUID

webapp/views.py

@@ -6,13 +6,14 @@ from django.utils import timezone
 from dealer.git import git
 from django.conf import settings
 from django.http import HttpResponse, JsonResponse
-from django.shortcuts import render
+from django.shortcuts import render, get_object_or_404
 from django.views.decorators.http import require_http_methods
 from django_filters import rest_framework as filters
 from django.core.exceptions import ObjectDoesNotExist
 from rest_framework import routers, viewsets
 from rest_framework.filters import OrderingFilter, SearchFilter
-from rest_framework.permissions import IsAuthenticatedOrReadOnly, BasePermission
+from rest_framework.decorators import action
+from rest_framework.permissions import IsAuthenticatedOrReadOnly, BasePermission, AllowAny
 from jsonschema import validate
 from jsonschema.exceptions import ValidationError
 
@@ -22,7 +23,7 @@ from webapp.serializers import (EventSerializer, SignupFormSerializer, SignupSer
                                 OccupationSerializer, TagSerializer)
 
 
-class IsPostOrIsAuthenticated(BasePermission):
+class SignupPermission(BasePermission):
 
     def has_permission(self, request, view):
         if request.method == 'POST':
@@ -58,10 +59,6 @@ class SignupFormViewSet(viewsets.ModelViewSet):
     queryset = SignupForm.objects.all()
     serializer_class = SignupFormSerializer
     permission_classes = [IsAuthenticatedOrReadOnly]
-    # Throws errors with JSONFIeld. Modify __all__ to not use JSONField if filters are enadbled
-    # filter_backends = (filters.DjangoFilterBackend, SearchFilter, OrderingFilter)
-    # filter_fields = '__all__'
-    # search_fields = '__all__'
 
     def create(self, request, *args, **kwargs):
         try:
@@ -82,10 +79,18 @@ class SignupFormViewSet(viewsets.ModelViewSet):
 class SignupViewSet(viewsets.ModelViewSet):
     queryset = Signup.objects.all()
     serializer_class = SignupSerializer
-    permission_classes = [IsPostOrIsAuthenticated]
-    # filter_backends = (filters.DjangoFilterBackend, SearchFilter, OrderingFilter)
-    # filter_fields = '__all__'
-    # search_fields = '__all__'
+    permission_classes = [SignupPermission]
+
+    @action(detail=True, methods=['get', 'post'], permission_classes=[AllowAny])
+    def edit(self, request, pk=None, *args, **kwargs):
+        uuid = request.query_params.get("uuid", None)
+        queryset = self.filter_queryset(self.get_queryset())
+        filter = {'pk': pk, 'uuid': uuid}
+        signup = get_object_or_404(queryset, **filter)
+        if request.method == 'GET':
+            return self.retrieve(request, *args, **kwargs)
+        elif request.method == 'POST':
+            return self.partial_update(request, *args, **kwargs)
 
     def create(self, request, *args, **kwargs):
         id = request.data["signupForm_id"]
@@ -103,8 +108,24 @@ class SignupViewSet(viewsets.ModelViewSet):
         else:
             return JsonResponse(status=404, data={"error": f"SignupForm {id} not found"})
 
-    def update(self, request, *args, **kwargs):
-        return super().update(request, *args, **kwargs)
+    def partial_update(self, request, pk=None, *args, **kwargs):
+        try:
+            # ID & UUID validated in edit @action for normal users.
+            # This is otherwise open for authenticated users.
+            signup = self.get_object()
+            answer = request.data["answer"]
+            form = SignupForm.objects.get(id=signup.signupForm_id)
+
+            if (form.visible):
+                # Throws ValidationError if not valid
+                validate(instance=answer, schema=form.schema)
+                return super().partial_update(request, *args, **kwargs)
+        except ValidationError as inst:
+            return JsonResponse(status=400, data={"error": inst.message})
+        except ObjectDoesNotExist:
+            return JsonResponse(status=404, data={"error": f"SignupForm {id} not found"})
+        else:
+            return JsonResponse(status=404, data={"error": f"SignupForm {id} not found"})
 
 
 class SavedQuestionsViewSet(viewsets.ModelViewSet):