[WIP] API Forms

InvenTree/InvenTree/api_tester.py

@@ -78,6 +78,22 @@ def assignRole(self, role):
                 ruleset.save()
                 break
 
+    def getActions(self, url):
+        """
+        Return a dict of the 'actions' available at a given endpoint.
+        Makes use of the HTTP 'OPTIONS' method to request this.
+        """
+
+        response = self.client.options(url)
+        self.assertEqual(response.status_code, 200)
+
+        actions = response.data.get('actions', None)
+
+        if not actions:
+            actions = {}
+
+        return actions
+
     def get(self, url, data={}, expected_code=200):
         """
         Issue a GET request

InvenTree/InvenTree/fields.py

@@ -14,8 +14,10 @@
 from django import forms
 
 from decimal import Decimal
+
 from djmoney.models.fields import MoneyField as ModelMoneyField
 from djmoney.forms.fields import MoneyField
+from djmoney.models.validators import MinMoneyValidator
 
 import InvenTree.helpers
 import common.settings
@@ -47,7 +49,10 @@ def money_kwargs():
 
 
 class InvenTreeModelMoneyField(ModelMoneyField):
-    """ custom MoneyField for clean migrations while using dynamic currency settings """
+    """
+    Custom MoneyField for clean migrations while using dynamic currency settings
+    """
+
     def __init__(self, **kwargs):
         # detect if creating migration
         if 'makemigrations' in sys.argv:
@@ -58,6 +63,16 @@ def __init__(self, **kwargs):
             # set defaults
             kwargs.update(money_kwargs())
 
+        # Set a minimum value validator
+        validators = kwargs.get('validators', [])
+
+        if len(validators) == 0:
+            validators.append(
+                MinMoneyValidator(0),
+            )
+
+        kwargs['validators'] = validators
+
         super().__init__(**kwargs)
 
     def formfield(self, **kwargs):

InvenTree/InvenTree/metadata.py

@@ -0,0 +1,172 @@
+# -*- coding: utf-8 -*-
+
+from __future__ import unicode_literals
+
+import logging
+
+from rest_framework import serializers
+from rest_framework.metadata import SimpleMetadata
+from rest_framework.utils import model_meta
+from rest_framework.fields import empty
+
+import users.models
+
+
+logger = logging.getLogger('inventree')
+
+
+class InvenTreeMetadata(SimpleMetadata):
+    """
+    Custom metadata class for the DRF API.
+
+    This custom metadata class imits the available "actions",
+    based on the user's role permissions.
+
+    Thus when a client send an OPTIONS request to an API endpoint,
+    it will only receive a list of actions which it is allowed to perform!
+
+    Additionally, we include some extra information about database models,
+    so we can perform lookup for ForeignKey related fields.
+
+    """
+
+    def determine_metadata(self, request, view):
+
+        metadata = super().determine_metadata(request, view)
+
+        user = request.user
+
+        if user is None:
+            # No actions for you!
+            metadata['actions'] = {}
+            return metadata
+
+        try:
+            # Extract the model name associated with the view
+            self.model = view.serializer_class.Meta.model
+
+            # Construct the 'table name' from the model
+            app_label = self.model._meta.app_label
+            tbl_label = self.model._meta.model_name
+
+            metadata['model'] = tbl_label
+
+            table = f"{app_label}_{tbl_label}"
+
+            actions = metadata.get('actions', None)
+
+            if actions is not None:
+
+                check = users.models.RuleSet.check_table_permission
+
+                # Map the request method to a permission type
+                rolemap = {
+                    'POST': 'add',
+                    'PUT': 'change',
+                    'PATCH': 'change',
+                    'DELETE': 'delete',
+                }
+
+                # Remove any HTTP methods that the user does not have permission for
+                for method, permission in rolemap.items():
+                    if method in actions and not check(user, table, permission):
+                        del actions[method]
+
+                # Add a 'DELETE' action if we are allowed to delete
+                if 'DELETE' in view.allowed_methods and check(user, table, 'delete'):
+                    actions['DELETE'] = True
+
+                # Add a 'VIEW' action if we are allowed to view
+                if 'GET' in view.allowed_methods and check(user, table, 'view'):
+                    actions['GET'] = True
+
+        except AttributeError:
+            # We will assume that if the serializer class does *not* have a Meta
+            # then we don't need a permission
+            pass
+
+        return metadata
+
+    def get_serializer_info(self, serializer):
+        """
+        Override get_serializer_info so that we can add 'default' values
+        to any fields whose Meta.model specifies a default value
+        """
+
+        serializer_info = super().get_serializer_info(serializer)
+
+        try:
+            ModelClass = serializer.Meta.model
+
+            model_fields = model_meta.get_field_info(ModelClass)
+
+            # Iterate through simple fields
+            for name, field in model_fields.fields.items():
+
+                if field.has_default() and name in serializer_info.keys():
+
+                    default = field.default
+
+                    if callable(default):
+                        try:
+                            default = default()
+                        except:
+                            continue
+
+                    serializer_info[name]['default'] = default
+
+            # Iterate through relations
+            for name, relation in model_fields.relations.items():
+
+                if name not in serializer_info.keys():
+                    # Skip relation not defined in serializer
+                    continue
+
+                if relation.reverse:
+                    # Ignore reverse relations
+                    continue
+
+                # Extract and provide the "limit_choices_to" filters
+                # This is used to automatically filter AJAX requests
+                serializer_info[name]['filters'] = relation.model_field.get_limit_choices_to()
+
+                if 'help_text' not in serializer_info[name] and hasattr(relation.model_field, 'help_text'):
+                    serializer_info[name]['help_text'] = relation.model_field.help_text
+
+        except AttributeError:
+            pass
+
+        return serializer_info
+
+    def get_field_info(self, field):
+        """
+        Given an instance of a serializer field, return a dictionary
+        of metadata about it.
+
+        We take the regular DRF metadata and add our own unique flavor
+        """
+
+        # Run super method first
+        field_info = super().get_field_info(field)
+
+        # If a default value is specified for the serializer field, add it!
+        if 'default' not in field_info and not field.default == empty:
+            field_info['default'] = field.get_default()
+
+        # Introspect writable related fields
+        if field_info['type'] == 'field' and not field_info['read_only']:
+
+            # If the field is a PrimaryKeyRelatedField, we can extract the model from the queryset
+            if isinstance(field, serializers.PrimaryKeyRelatedField):
+                model = field.queryset.model
+            else:
+                logger.debug("Could not extract model for:", field_info['label'], '->', field)
+                model = None
+
+            if model:
+                # Mark this field as "related", and point to the URL where we can get the data!
+                field_info['type'] = 'related field'
+                field_info['api_url'] = model.get_api_url()
+                field_info['model'] = model._meta.model_name
+
+        return field_info

InvenTree/InvenTree/models.py

@@ -10,11 +10,13 @@
 from django.contrib.auth.models import User
 from django.contrib.contenttypes.models import ContentType
 from django.utils.translation import gettext_lazy as _
+from django.core.exceptions import ValidationError
 
 from django.db.models.signals import pre_delete
 from django.dispatch import receiver
 
 from mptt.models import MPTTModel, TreeForeignKey
+from mptt.exceptions import InvalidMove
 
 from .validators import validate_tree_name
 
@@ -91,6 +93,15 @@ class InvenTreeTree(MPTTModel):
         parent: The item immediately above this one. An item with a null parent is a top-level item
     """
 
+    def save(self, *args, **kwargs):
+
+        try:
+            super().save(*args, **kwargs)
+        except InvalidMove:
+            raise ValidationError({
+                'parent': _("Invalid choice"),
+            })
+
     class Meta:
         abstract = True
 

InvenTree/InvenTree/serializers.py

@@ -5,16 +5,58 @@
 # -*- coding: utf-8 -*-
 from __future__ import unicode_literals
 
+
 import os
 
+from decimal import Decimal
+
 from django.conf import settings
 from django.contrib.auth.models import User
 from django.core.exceptions import ValidationError as DjangoValidationError
+from django.utils.translation import ugettext_lazy as _
+
+from djmoney.contrib.django_rest_framework.fields import MoneyField
+from djmoney.money import Money
+from djmoney.utils import MONEY_CLASSES, get_currency_field_name
 
 from rest_framework import serializers
 from rest_framework.utils import model_meta
 from rest_framework.fields import empty
 from rest_framework.exceptions import ValidationError
+from rest_framework.serializers import DecimalField
+
+
+class InvenTreeMoneySerializer(MoneyField):
+    """
+    Custom serializer for 'MoneyField',
+    which ensures that passed values are numerically valid
+
+    Ref: https://github.com/django-money/django-money/blob/master/djmoney/contrib/django_rest_framework/fields.py
+    """
+
+    def get_value(self, data):
+        """
+        Test that the returned amount is a valid Decimal
+        """
+
+        amount = super(DecimalField, self).get_value(data)
+
+        # Convert an empty string to None
+        if len(str(amount).strip()) == 0:
+            amount = None
+
+        try:
+            if amount is not None:
+                amount = Decimal(amount)
+        except:
+            raise ValidationError(_("Must be a valid number"))
+
+        currency = data.get(get_currency_field_name(self.field_name), self.default_currency)
+
+        if currency and amount is not None and not isinstance(amount, MONEY_CLASSES) and amount is not empty:
+            return Money(amount, currency)
+
+        return amount
 
 
 class UserSerializer(serializers.ModelSerializer):
@@ -110,6 +152,19 @@ def get_initial(self):
 
         return initials
 
+    def save(self, **kwargs):
+        """
+        Catch any django ValidationError thrown at the moment save() is called,
+        and re-throw as a DRF ValidationError
+        """
+
+        try:
+            super().save(**kwargs)
+        except (ValidationError, DjangoValidationError) as exc:
+            raise ValidationError(detail=serializers.as_serializer_error(exc))
+
+        return self.instance
+
     def run_validation(self, data=empty):
         """
         Perform serializer validation.

InvenTree/InvenTree/settings.py

@@ -342,6 +342,7 @@ def get_setting(environment_var, backup_val, default_value=None):
         'InvenTree.permissions.RolePermission',
     ),
     'DEFAULT_SCHEMA_CLASS': 'rest_framework.schemas.coreapi.AutoSchema',
+    'DEFAULT_METADATA_CLASS': 'InvenTree.metadata.InvenTreeMetadata'
 }
 
 WSGI_APPLICATION = 'InvenTree.wsgi.application'