fix

backend/time_tracking/serializers.py

@@ -1,34 +1,82 @@
 from rest_framework import serializers
-from django.contrib.auth.models import User
+from django.contrib.auth import get_user_model
+
 from .models import TimeEntry
 
+
+User = get_user_model()
+
+
+class UserSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = User
+        fields = ['id', 'username', 'first_name', 'last_name']
+
+
 class TimeEntrySerializer(serializers.ModelSerializer):
+    user = UserSerializer(read_only=True)
+
     class Meta:
         model = TimeEntry
-        fields = '__all__'
-        read_only_fields = ('user',)
+        fields = [
+            'id',
+            'user',
+            'date',
+            'start_time',
+            'end_time',
+            'created_at',
+            'updated_at',
+            'duration',
+            'day_of_week',
+        ]
+        read_only_fields = [
+            'id',
+            'user',
+            'created_at',
+            'updated_at',
+            'duration',
+            'day_of_week',
+        ]
 
     def create(self, validated_data):
-        # Set the user to the current request user
         validated_data['user'] = self.context['request'].user
         return super().create(validated_data)
 
     def update(self, instance, validated_data):
-        # Prevent updating the user field
         validated_data.pop('user', None)
         return super().update(instance, validated_data)
+
+
 class TimeEntryCreateSerializer(serializers.ModelSerializer):
+    user_id = serializers.PrimaryKeyRelatedField(
+        source='user',
+        queryset=User.objects.all(),
+        write_only=True,
+        required=False,
+    )
+
     class Meta:
         model = TimeEntry
-        fields = ['date', 'start_time', 'end_time']
+        fields = ['user_id', 'date', 'start_time', 'end_time']
 
     def validate(self, attrs):
         if not attrs.get('start_time') and not attrs.get('end_time'):
-            raise serializers.ValidationError('Une heure d’entrée ou de sortie est requise.')
-        if attrs.get('start_time') and attrs.get('end_time') and attrs['end_time'] <= attrs['start_time']:
-            raise serializers.ValidationError('L’heure de sortie doit être après l’heure d’entrée.')
+            raise serializers.ValidationError(
+                'Une heure d’entrée ou de sortie est requise.'
+            )
+
+        if (
+            attrs.get('start_time')
+            and attrs.get('end_time')
+            and attrs['end_time'] <= attrs['start_time']
+        ):
+            raise serializers.ValidationError(
+                'L’heure de sortie doit être après l’entrée.'
+            )
+
         return attrs
 
+
 class TimeEntryUpdateSerializer(serializers.ModelSerializer):
     class Meta:
         model = TimeEntry
@@ -36,13 +84,24 @@ class TimeEntryUpdateSerializer(serializers.ModelSerializer):
 
     def validate(self, attrs):
         if not attrs.get('start_time') and not attrs.get('end_time'):
-            raise serializers.ValidationError('Une heure d’entrée ou de sortie est requise.')
-        if attrs.get('start_time') and attrs.get('end_time') and attrs['end_time'] <= attrs['start_time']:
-            raise serializers.ValidationError('L’heure de sortie doit être après l’heure d’entrée.')
+            raise serializers.ValidationError(
+                'Une heure d’entrée ou de sortie est requise.'
+            )
+
+        if (
+            attrs.get('start_time')
+            and attrs.get('end_time')
+            and attrs['end_time'] <= attrs['start_time']
+        ):
+            raise serializers.ValidationError(
+                'L’heure de sortie doit être après l’heure d’entrée.'
+            )
+
         return attrs
 
+
 class WeeklySummarySerializer(serializers.Serializer):
     user = serializers.CharField()
     username = serializers.CharField()
     total_hours = serializers.FloatField()
-    entries = serializers.ListField(child=serializers.DictField())
+    entries = serializers.ListField(child=serializers.DictField())

backend/time_tracking/views.py

@@ -32,7 +32,40 @@ class TimeEntryCreateView(generics.CreateAPIView):
     permission_classes = [IsAuthenticated]
 
     def perform_create(self, serializer):
-        serializer.save(user=self.request.user)
+        requested_user = serializer.validated_data.pop('user', None)
+
+        if requested_user is not None:
+            if not (
+                self.request.user.is_staff
+                or self.request.user.is_superuser
+            ):
+                from rest_framework.exceptions import PermissionDenied
+
+                raise PermissionDenied(
+                    "Vous ne pouvez pas créer un pointage pour un autre utilisateur."
+                )
+
+            self.created_entry = serializer.save(user=requested_user)
+        else:
+            self.created_entry = serializer.save(user=self.request.user)
+
+    def create(self, request, *args, **kwargs):
+        serializer = self.get_serializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        self.perform_create(serializer)
+
+        output_serializer = TimeEntrySerializer(
+            self.created_entry,
+            context={'request': request},
+        )
+
+        headers = self.get_success_headers(serializer.data)
+
+        return Response(
+            output_serializer.data,
+            status=status.HTTP_201_CREATED,
+            headers=headers,
+        )
 
 class TimeEntryScanView(APIView):
     permission_classes = [IsAuthenticated]