Add endpoints to viewsets

src/openforms/forms/api/permissions.py

@@ -0,0 +1,12 @@
+from rest_framework.permissions import SAFE_METHODS, BasePermission
+
+
+class IsStaffOrReadOnly(BasePermission):
+ """
+ The request is a staff user, or is a read-only request.
+ """
+
+ def has_permission(self, request, view):
+ return request.method in SAFE_METHODS or (
+ request.user and request.user.is_staff
+ )

src/openforms/forms/api/serializers.py

@@ -1,4 +1,4 @@
-import json
+from django.shortcuts import get_object_or_404
 
 from rest_framework import serializers
 from rest_framework_nested.relations import NestedHyperlinkedRelatedField
@@ -83,14 +83,29 @@ class Meta:
  }
 
 
-class FormStepSerializer(serializers.ModelSerializer):
- index = serializers.IntegerField(source="order")
- configuration = serializers.JSONField(source="form_definition.configuration")
+class FormStepSerializer(serializers.HyperlinkedModelSerializer):
+ index = serializers.IntegerField(source="order", read_only=True)
+ configuration = serializers.JSONField(
+ source="form_definition.configuration", read_only=True
+ )
 
  parent_lookup_kwargs = {
  "form_uuid": "form__uuid",
  }
 
  class Meta:
  model = FormStep
- fields = ("index", "configuration")
+ fields = ("index", "configuration", "form_definition")
+
+ extra_kwargs = {
+ "form_definition": {
+ "view_name": "api:formdefinition-detail",
+ "lookup_field": "uuid",
+ },
+ }
+
+ def create(self, validated_data):
+ validated_data["form"] = get_object_or_404(
+ Form, uuid=self.context["view"].kwargs["form_uuid"]
+ )
+ return super().create(validated_data)

src/openforms/forms/api/viewsets.py

@@ -2,14 +2,15 @@
 
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiParameter, extend_schema, extend_schema_view
-from rest_framework import permissions, status, viewsets
+from rest_framework import mixins, permissions, status, viewsets
 from rest_framework.decorators import action
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework_nested.viewsets import NestedViewSetMixin
 
 from openforms.api.pagination import PageNumberPagination
 
+from ..api.permissions import IsStaffOrReadOnly
 from ..api.serializers import (
  FormDefinitionSerializer,
  FormSerializer,
@@ -18,13 +19,6 @@
 from ..models import Form, FormDefinition, FormStep
 
 
-class BaseFormsViewSet(viewsets.ReadOnlyModelViewSet):
- lookup_field = "uuid"
- # anonymous clients must be able to get the form definitions in the browser
- # The DRF settings apply some default throttling to mitigate abuse
- permission_classes = [permissions.AllowAny]
-
-
 @extend_schema(
  parameters=[
  OpenApiParameter("form_uuid", OpenApiTypes.UUID, location=OpenApiParameter.PATH)
@@ -33,10 +27,19 @@ class BaseFormsViewSet(viewsets.ReadOnlyModelViewSet):
 @extend_schema_view(
  list=extend_schema(summary=_("List form steps")),
  retrieve=extend_schema(summary=_("Retrieve form step details")),
+ create=extend_schema(summary=_("Create a form step")),
+ update=extend_schema(summary=_("Update all details of a form step")),
+ partial_update=extend_schema(summary=_("Update some details of a form step")),
+ destroy=extend_schema(summary=_("Delete a form step")),
 )
-class FormStepViewSet(NestedViewSetMixin, BaseFormsViewSet):
+class FormStepViewSet(
+ NestedViewSetMixin,
+ viewsets.ModelViewSet,
+):
  serializer_class = FormStepSerializer
  queryset = FormStep.objects.all()
+ permission_classes = [IsStaffOrReadOnly]
+ lookup_field = "uuid"
 
 
 @extend_schema_view(
@@ -49,10 +52,14 @@ class FormStepViewSet(NestedViewSetMixin, BaseFormsViewSet):
  tags=["forms"],
  ),
 )
-class FormDefinitionViewSet(BaseFormsViewSet):
+class FormDefinitionViewSet(viewsets.ReadOnlyModelViewSet):
  queryset = FormDefinition.objects.order_by("slug")
  serializer_class = FormDefinitionSerializer
  pagination_class = PageNumberPagination
+ lookup_field = "uuid"
+ # anonymous clients must be able to get the form definitions in the browser
+ # The DRF settings apply some default throttling to mitigate abuse
+ permission_classes = [permissions.AllowAny]
 
  def get_serializer_context(self) -> dict:
  context = super().get_serializer_context()
@@ -79,7 +86,14 @@ def configuration(self, request: Request, *args, **kwargs):
 @extend_schema_view(
  list=extend_schema(summary=_("List forms")),
  retrieve=extend_schema(summary=_("Retrieve form details")),
+ create=extend_schema(summary=_("Create form")),
+ update=extend_schema(summary=_("Update all details of a form")),
+ partial_update=extend_schema(summary=_("Update given details of a form")),
 )
-class FormViewSet(BaseFormsViewSet):
+class FormViewSet(
+ mixins.CreateModelMixin, mixins.UpdateModelMixin, viewsets.ReadOnlyModelViewSet
+):
  queryset = Form.objects.filter(active=True)
+ lookup_field = "uuid"
  serializer_class = FormSerializer
+ permission_classes = [IsStaffOrReadOnly]