110 lines
4.1 KiB
Python
110 lines
4.1 KiB
Python
from rest_framework import generics
|
|
from rest_framework.response import Response
|
|
from rest_framework.permissions import AllowAny, IsAuthenticated
|
|
from rest_framework.views import APIView
|
|
from rest_framework.exceptions import PermissionDenied
|
|
from django.utils import timezone
|
|
from datetime import timedelta
|
|
from django.contrib.auth.models import User
|
|
from .models import Invitation
|
|
from .serializers import UserSerializer, RegisterSerializer
|
|
|
|
class RegisterView(generics.CreateAPIView):
|
|
queryset = User.objects.all()
|
|
permission_classes = (AllowAny,)
|
|
serializer_class = RegisterSerializer
|
|
|
|
class UserMeView(generics.RetrieveAPIView):
|
|
permission_classes = (IsAuthenticated,)
|
|
serializer_class = UserSerializer
|
|
|
|
def get_object(self):
|
|
return self.request.user
|
|
|
|
|
|
class UserListView(generics.ListAPIView):
|
|
permission_classes = (IsAuthenticated,)
|
|
serializer_class = UserSerializer
|
|
|
|
def get_queryset(self):
|
|
if not (self.request.user.is_staff or self.request.user.is_superuser):
|
|
raise PermissionDenied('Seuls les administrateurs peuvent consulter les comptes.')
|
|
return User.objects.order_by('-date_joined')
|
|
|
|
|
|
class UserDetailView(generics.RetrieveUpdateDestroyAPIView):
|
|
permission_classes = (IsAuthenticated,)
|
|
serializer_class = UserSerializer
|
|
|
|
def get_queryset(self):
|
|
if not (self.request.user.is_staff or self.request.user.is_superuser):
|
|
raise PermissionDenied('Seuls les administrateurs peuvent modifier les comptes.')
|
|
return User.objects.all()
|
|
|
|
def update(self, request, *args, **kwargs):
|
|
# For updating user permissions, we need to handle is_staff and is_superuser specially
|
|
if not (request.user.is_staff or request.user.is_superuser):
|
|
raise PermissionDenied('Seuls les administrateurs peuvent modifier les comptes.')
|
|
|
|
user = self.get_object()
|
|
# Only allow updating specific fields
|
|
allowed_fields = ['is_staff', 'is_superuser']
|
|
for field in allowed_fields:
|
|
if field in request.data:
|
|
setattr(user, field, request.data[field])
|
|
|
|
user.save()
|
|
serializer = self.get_serializer(user)
|
|
return Response(serializer.data)
|
|
|
|
|
|
class UserPromoteView(APIView):
|
|
permission_classes = (IsAuthenticated,)
|
|
|
|
def post(self, request, user_id):
|
|
if not (request.user.is_staff or request.user.is_superuser):
|
|
raise PermissionDenied('Seuls les administrateurs peuvent promouvoir des utilisateurs.')
|
|
|
|
try:
|
|
user = User.objects.get(id=user_id)
|
|
user.is_staff = True
|
|
user.save()
|
|
return Response({'message': 'Utilisateur promu avec succès'}, status=200)
|
|
except User.DoesNotExist:
|
|
return Response({'error': 'Utilisateur non trouvé'}, status=404)
|
|
|
|
|
|
class UserDeleteView(APIView):
|
|
permission_classes = (IsAuthenticated,)
|
|
|
|
def delete(self, request, user_id):
|
|
if not (request.user.is_staff or request.user.is_superuser):
|
|
raise PermissionDenied('Seuls les administrateurs peuvent supprimer des utilisateurs.')
|
|
|
|
try:
|
|
user = User.objects.get(id=user_id)
|
|
# Ne pas permettre de supprimer l'utilisateur courant
|
|
if user == request.user:
|
|
return Response({'error': 'Vous ne pouvez pas supprimer votre propre compte'}, status=400)
|
|
|
|
user.delete()
|
|
return Response({'message': 'Utilisateur supprimé avec succès'}, status=200)
|
|
except User.DoesNotExist:
|
|
return Response({'error': 'Utilisateur non trouvé'}, status=404)
|
|
|
|
|
|
class InvitationCreateView(APIView):
|
|
permission_classes = (IsAuthenticated,)
|
|
|
|
def post(self, request):
|
|
if not (request.user.is_staff or request.user.is_superuser):
|
|
raise PermissionDenied('Seuls les administrateurs peuvent créer une invitation.')
|
|
invitation = Invitation.objects.create(
|
|
created_by=request.user,
|
|
expires_at=timezone.now() + timedelta(days=7),
|
|
)
|
|
return Response({
|
|
'token': str(invitation.token),
|
|
'expires_at': invitation.expires_at,
|
|
}, status=201)
|