As you can see, if you using django-rest-framework, you will found many different response format. This middleware to solve all of these problems with Standard API Response.
All HTTP Response status stored into json response, not in HTTP Status (because mobile application, like android can't fetch the response body when HTTP Status >= 400).
Say you want to keep your API secure and thus it has authentication, but there's this one View action in a ViewSet which unlike the rest of the ViewSet's actions needs to allow free access without authentication.
This solution applies the good old `IsAuthenticated` permission to all ViewSet actions except those defined in a `login_exempt_actions` list. That's a list of the ViewSet action's names.
This is a simple solution for this particular problem, which I imagine could be quite common.
Any case where the requirements are more complex should implement one of the DRF permissions extensions which allow for the use of logical operators.
**NOTE**: Remember that `request.user` will be an `AnonymousUser` instance, so be careful with any code which assumes it'll be a `User` instance. This could be the case with, say, a custom `get_queryset` implementation.
In case you ever use [requests](http://python-requests.org/) (or [slumber](http://slumber.in/)) to do requests against a Tastypie API that requires API key authentication, this small custom auth class will help you.
Use it like that (with requests):
auth = TastypieApiKeyAuth('jezdez', '25fdd0d9d210acb78b5b845fe8284a3c93630252')
response = requests.get('http://api.foo.bar/v1/spam/', auth=auth)
or with slumber:
auth = TastypieApiKeyAuth('jezdez', '25fdd0d9d210acb78b5b845fe8284a3c93630252')
api = slumber.API("http://api.foo.bar/v1/", auth=auth)
spam = api.spam().get()
Whip up an AJAX API for your site in a jiffy:
class MySite(AJAXApi):
@AJAXApi.export
def hello(request):
return {'content': self.get_content()}
def get_content(self):
return 'Hello, world!'
urlpatterns += MySite().url_patterns()
(the example needs the JSON encoding middleware of [snippet 803](http://www.djangosnippets.org/snippets/803/) to work.)
The secret is that bound instance methods are callable too, so work as views. (Most Django people only use functions, or sometimes classes with `__call__`, as view functions.)
You get implicit type dispatch off that `self` object. So you could subclass `MySite`, change `get_content`, and still use the same `hello` method.
See (django-webapp)[http://code.google.com/p/django-webapp/] for a REST-ish Resource class using this same idea.
You can clearly do better than my `func_to_view`, and also make a better decorator than `exported` (so you can actually say `@exported('name') def function()` etc.). This is more of a proof of concept that should work for most people.
Caveat: I've changed a few things since I last really tested this.
(psst, this also works for non-AJAX views too.)
This view will provide a link for AuthSub proxy authentication to the Google Contacts API and then grab the user's Google contacts and compare against User.email for possible user relationships.
A couple of things to note:
* Dependency on the GData Python client library:
http://code.google.com/p/gdata-python-client/
* The domain hosting the view must be verified by Google's domain manager (otherwise API calls will result in a 403):
https://www.google.com/accounts/ManageDomains
Thanks to Simon for get_url_host and get_full_url.