feat: basic readonly user API

pyproject.toml

@@ -22,6 +22,8 @@ dependencies = [
     "psycopg[binary]~=3.2.7",
     "django-types~=0.20.0",
     "django-ipware~=7.0.1",
+    "djangorestframework>=3.16.1",
+    "djangorestframework-stubs>=3.16.6",
 ]
 
 [tool.ruff.lint]

trojstenid/settings.py

@@ -42,6 +42,8 @@
     "django.contrib.sites",
     "django.contrib.staticfiles",
     "django.contrib.postgres",
+    "rest_framework",
+    "rest_framework.authtoken",
     "debug_toolbar",
     "trojstenid.users",
     "trojstenid.profiles",
@@ -211,6 +213,13 @@
 
 DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
 
+REST_FRAMEWORK = {
+    "DEFAULT_AUTHENTICATION_CLASSES": [
+        "rest_framework.authentication.SessionAuthentication",
+        "rest_framework.authentication.TokenAuthentication",
+    ],
+}
+
 
 LOGGING = {
     "version": 1,

trojstenid/urls.py

@@ -30,6 +30,7 @@
     path("accounts/profile/", views.ProfileView.as_view(), name="account_profile"),
     path("accounts/", include("allauth.urls")),
     path("oauth/", include("trojstenid.users.urls_oauth", namespace="oauth2_provider")),
+    path("api/", include("trojstenid.users.urls_api", namespace="api")),
 ]
 
 if settings.DEBUG:

trojstenid/users/serializers.py

@@ -0,0 +1,58 @@
+from allauth.account.models import EmailAddress
+from django.contrib.auth.models import Group
+from rest_framework import serializers
+
+from trojstenid.users.models import User
+
+
+class UserSchoolRecordSerializer(serializers.BaseSerializer):
+    def to_representation(self, instance):
+        return instance.to_dict()
+
+
+class EmailAddressSerializer(serializers.ModelSerializer):
+    class Meta:  # type:ignore
+        model = EmailAddress
+        fields = ["email", "verified", "primary"]
+
+
+class UserSerializer(serializers.ModelSerializer):
+    current_school_record = serializers.SerializerMethodField()
+    groups = serializers.SlugRelatedField(
+        slug_field="name", many=True, queryset=Group.objects.get_queryset()
+    )
+    emails = EmailAddressSerializer(many=True, source="emailaddress_set")
+
+    class Meta:  # type:ignore
+        model = User
+        fields = [
+            "id",
+            "username",
+            "email",
+            "first_name",
+            "last_name",
+            "is_staff",
+            "is_active",
+            "date_joined",
+            "last_login",
+            "avatar",
+            "current_school_record",
+            "groups",
+            "emails",
+        ]
+
+    def get_current_school_record(self, obj):
+        record = obj.get_current_school_record()
+        return UserSchoolRecordSerializer(record).data if record else None
+
+
+class UserListSerializer(UserSerializer):
+    class Meta(UserSerializer.Meta):
+        fields = [
+            "id",
+            "username",
+            "email",
+            "first_name",
+            "last_name",
+            "avatar",
+        ]

trojstenid/users/urls_api.py

@@ -0,0 +1,16 @@
+from django.urls import path
+
+from trojstenid.users.views_api import (
+    UserDetailView,
+    UserListView,
+)
+
+app_name = "api"
+
+urlpatterns = [
+    path("users/", UserListView.as_view(), name="user-list"),
+    path("users/<int:id>/", UserDetailView.as_view(), name="user-detail-id"),
+    path(
+        "users/<str:username>/", UserDetailView.as_view(), name="user-detail-username"
+    ),
+]

trojstenid/users/views_api.py

@@ -0,0 +1,60 @@
+from django.db.models import Q
+from rest_framework import generics, permissions
+
+from trojstenid.users.models import User
+from trojstenid.users.serializers import UserListSerializer, UserSerializer
+
+
+class UserListView(generics.ListAPIView):
+    """
+    List all users.
+    Search by username, email, or name using ?search=.
+    """
+
+    serializer_class = UserListSerializer
+    permission_classes = [permissions.IsAuthenticated]
+
+    def get_queryset(self):
+        user: User = self.request.user  # type:ignore
+        search_query = self.request.GET.get("search", None)
+
+        if user.is_staff:
+            qs = User.objects.all()
+        else:
+            qs = User.objects.filter(id=user.id)
+
+        if search_query:
+            qs = qs.filter(
+                Q(username__icontains=search_query)
+                | Q(email__icontains=search_query)
+                | Q(first_name__unaccent__icontains=search_query)
+                | Q(last_name__unaccent__icontains=search_query)
+            )
+
+        return qs
+
+
+class UserDetailView(generics.RetrieveAPIView):
+    """
+    Retrieve a single user by ID or username.
+    """
+
+    serializer_class = UserSerializer
+    permission_classes = [permissions.IsAuthenticated]
+    lookup_field = "id"
+
+    def get_object(self):
+        user: User = self.request.user  # type:ignore
+        lookup_value = self.kwargs.get(self.lookup_field) or self.kwargs.get("username")
+
+        qs = User.objects.prefetch_related(
+            "userschoolrecord_set", "groups", "emailaddress_set"
+        )
+
+        if not user.is_staff:
+            qs = qs.filter(id=user.id)
+
+        try:
+            return qs.get(id=int(lookup_value))
+        except (ValueError, User.DoesNotExist):
+            return qs.get(username=lookup_value)