# Path: yawn/user/permissions.py
# class ModelPermissions(BasePermission):
#     """Allow authenticated users to read, and staff to write"""
# 
#     def has_permission(self, request, view):
#         # Workaround to ensure DjangoModelPermissions are not applied
#         # to the root view when using DefaultRouter.
#         if getattr(view, '_ignore_model_permissions', False):
#             return True
# 
#         if not request.user.is_authenticated:
#             return False
# 
#         if request.user.is_staff:
#             return True
# 
#         # authenticated, but not staff: only allow read
#         return request.method in ('GET', 'HEAD', 'OPTIONS')
# 
# Path: yawn/user/serializers.py
# class UserSerializer(serializers.ModelSerializer):
#     api_token = serializers.CharField(source='auth_token.key', read_only=True)
#     refresh_token = serializers.BooleanField(write_only=True, default=False)
#     password = serializers.CharField(write_only=True)
# 
#     class Meta:
#         model = User
#         fields = ('username', 'first_name', 'last_name', 'api_token', 'email',
#                   'refresh_token', 'id', 'password', 'is_staff')
# 
#     def create(self, validated_data):
#         validated_data.pop('refresh_token', None)
#         return User.objects.create_user(**validated_data)
# 
#     def update(self, instance, validated_data):
#         # support refreshing the token:
#         if validated_data.pop('refresh_token', False):
#             if hasattr(instance, 'auth_token'):
#                 instance.auth_token.delete()
#             instance.auth_token = Token.objects.create(user=instance)
#         # and setting the password, which causes an unhandled logout...
#         if validated_data.get('password'):
#             instance.set_password(validated_data.pop('password'))
#         return super().update(instance, validated_data)
# 
# class LoginSerializer(serializers.Serializer):
#     username = serializers.CharField()
#     password = serializers.CharField()


from django.contrib.auth.models import User
from django.contrib.auth import authenticate, login, logout
from rest_framework import viewsets, status
    from rest_framework.decorators import action
    from rest_framework.decorators import list_route as action
from rest_framework.response import Response
from rest_framework.permissions import AllowAny
from rest_framework.settings import api_settings
from yawn.user.permissions import ModelPermissions
from .serializers import UserSerializer, LoginSerializer
try:
except ImportError:



class UserViewSet(viewsets.GenericViewSet,
                  viewsets.mixins.ListModelMixin,
                  viewsets.mixins.CreateModelMixin,
                  viewsets.mixins.RetrieveModelMixin,
                  viewsets.mixins.UpdateModelMixin):
    """
    User endpoint, GET(list, detail), PATCH to change

    This ViewSet has `permission_classes` set and `/me/` has the default permissions
    so that the default permission class can be set to IsAuthenticatedOrReadOnly
    without leaking user API tokens.
    """
    queryset = User.objects.all().order_by('id')

    serializer_class = UserSerializer

# Path: yawn/user/permissions.py
# class ModelPermissions(BasePermission):
#     """Allow authenticated users to read, and staff to write"""
# 
#     def has_permission(self, request, view):
#         # Workaround to ensure DjangoModelPermissions are not applied
#         # to the root view when using DefaultRouter.
#         if getattr(view, '_ignore_model_permissions', False):
#             return True
# 
#         if not request.user.is_authenticated:
#             return False
# 
#         if request.user.is_staff:
#             return True
# 
#         # authenticated, but not staff: only allow read
#         return request.method in ('GET', 'HEAD', 'OPTIONS')
# 
# Path: yawn/user/serializers.py
# class UserSerializer(serializers.ModelSerializer):
#     api_token = serializers.CharField(source='auth_token.key', read_only=True)
#     refresh_token = serializers.BooleanField(write_only=True, default=False)
#     password = serializers.CharField(write_only=True)
# 
#     class Meta:
#         model = User
#         fields = ('username', 'first_name', 'last_name', 'api_token', 'email',
#                   'refresh_token', 'id', 'password', 'is_staff')
# 
#     def create(self, validated_data):
#         validated_data.pop('refresh_token', None)
#         return User.objects.create_user(**validated_data)
# 
#     def update(self, instance, validated_data):
#         # support refreshing the token:
#         if validated_data.pop('refresh_token', False):
#             if hasattr(instance, 'auth_token'):
#                 instance.auth_token.delete()
#             instance.auth_token = Token.objects.create(user=instance)
#         # and setting the password, which causes an unhandled logout...
#         if validated_data.get('password'):
#             instance.set_password(validated_data.pop('password'))
#         return super().update(instance, validated_data)
# 
# class LoginSerializer(serializers.Serializer):
#     username = serializers.CharField()
#     password = serializers.CharField()


# Path: yawn/user/views.py
from django.contrib.auth.models import User
from django.contrib.auth import authenticate, login, logout
from rest_framework import viewsets, status
    from rest_framework.decorators import action
    from rest_framework.decorators import list_route as action
from rest_framework.response import Response
from rest_framework.permissions import AllowAny
from rest_framework.settings import api_settings
from yawn.user.permissions import ModelPermissions
from .serializers import UserSerializer, LoginSerializer

try:
except ImportError:



class UserViewSet(viewsets.GenericViewSet,
                  viewsets.mixins.ListModelMixin,
                  viewsets.mixins.CreateModelMixin,
                  viewsets.mixins.RetrieveModelMixin,
                  viewsets.mixins.UpdateModelMixin):
    """
    User endpoint, GET(list, detail), PATCH to change

    This ViewSet has `permission_classes` set and `/me/` has the default permissions
    so that the default permission class can be set to IsAuthenticatedOrReadOnly
    without leaking user API tokens.
    """
    queryset = User.objects.all().order_by('id')

    serializer_class = UserSerializer

    permission_classes = (ModelPermissions,)