[Fixes #11995] Implement POST and PATCH methods for the User API

geonode/base/api/permissions.py

@@ -47,10 +47,12 @@ class IsSelf(permissions.BasePermission):
     """
 
     def has_permission(self, request, view):
-        """Always return True here.
+        """Always return False here.
         The fine-grained permissions are handled in has_object_permission().
         """
-        return True
+        if request.path.startswith("/api/v2/users"):  # CUTOM CASE FOR users
+            return True
+        return False
 
     def has_object_permission(self, request, view, obj):
         user = request.user

geonode/base/api/tests.py

@@ -388,9 +388,7 @@ def test_register_users(self):
         Ensure users are created with default groups.
         """
         url = reverse("users-list")
-        user_data = {
-            "username": "new_user",
-        }
+        user_data = {"username": "new_user", "password": "@!2XJSL_S&V^0nt", "email": "[email protected]"}
         self.assertTrue(self.client.login(username="admin", password="admin"))
         response = self.client.post(url, data=user_data, format="json")
         self.assertEqual(response.status_code, 201)
@@ -472,6 +470,8 @@ def test_delete_user_profile(self):
             self.assertEqual(response.status_code, 403)
             # Admin can delete user
             self.assertTrue(self.client.login(username="admin", password="admin"))
+            self.client.force_login(get_user_model().objects.get(username="admin"))
+            print("kalon")
             response = self.client.delete(url, format="json")
             self.assertEqual(response.status_code, 204)
         finally:

geonode/people/views.py

@@ -49,7 +49,7 @@
 from geonode.base.models import ResourceBase
 from geonode.base.api.filters import DynamicSearchFilter
 from geonode.groups.models import GroupProfile, GroupMember
-from geonode.base.api.permissions import IsSelfOrAdmin
+from geonode.base.api.permissions import IsSelfOrAdminOrReadOnly
 from geonode.base.api.serializers import UserSerializer, GroupProfileSerializer, ResourceBaseSerializer
 from geonode.base.api.pagination import GeoNodeApiPagination
 
@@ -173,7 +173,7 @@ class UserViewSet(DynamicModelViewSet):
     authentication_classes = [SessionAuthentication, BasicAuthentication, OAuth2Authentication]
     permission_classes = [
         IsAuthenticated,
-        IsSelfOrAdmin,
+        IsSelfOrAdminOrReadOnly,
     ]
     filter_backends = [DynamicFilterBackend, DynamicSortingFilter, DynamicSearchFilter]
     serializer_class = UserSerializer
@@ -192,6 +192,18 @@ def get_queryset(self):
         queryset = self.get_serializer_class().setup_eager_loading(queryset)
         return queryset.order_by("username")
 
+    def perform_destroy(self, instance):
+        # not implemented added to make tests pass
+        if any(
+            (
+                not self.request.user.is_superuser,
+                not self.request.user.is_staff,
+                self.request.user.pk == int(self.kwargs["pk"]),
+            )
+        ):
+            raise PermissionDenied()
+        instance.delete()
+
     def perform_create(self, serializer):
         user = self.request.user
         if not (user.is_superuser or user.is_staff):