[MOD-109][Feature] Reviews, Volume I: Moderation

admin/base/settings/defaults.py

@@ -88,9 +88,11 @@
     'webpack_loader',
     'django_nose',
     'password_reset',
+    'guardian',
 
     # OSF
     'osf',
+    'reviews',
 
     # Addons
     'addons.osfstorage',
@@ -114,6 +116,7 @@
 
 MIGRATION_MODULES = {
     'osf': None,
+    'reviews': None,
     'addons_osfstorage': None,
     'addons_wiki': None,
     'addons_twofactor': None,

api/actions/serializers.py

@@ -0,0 +1,142 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from rest_framework import generics
+from rest_framework import serializers as ser
+
+from api.base import utils
+from api.base.exceptions import Conflict
+from api.base.exceptions import JSONAPIAttributeException
+from api.base.serializers import JSONAPISerializer
+from api.base.serializers import LinksField
+from api.base.serializers import RelationshipField
+from api.base.serializers import HideIfProviderCommentsAnonymous
+from api.base.serializers import HideIfProviderCommentsPrivate
+
+from osf.models import PreprintService
+
+from reviews.exceptions import InvalidTriggerError
+from reviews.workflow import Triggers
+from reviews.workflow import States
+
+
+class ReviewableCountsRelationshipField(RelationshipField):
+
+    def __init__(self, *args, **kwargs):
+        kwargs['related_meta'] = kwargs.get('related_meta') or {}
+        if 'include_state_counts' not in kwargs['related_meta']:
+            kwargs['related_meta']['include_state_counts'] = True
+        super(ReviewableCountsRelationshipField, self).__init__(*args, **kwargs)
+
+    def get_meta_information(self, metadata, provider):
+        # Clone metadata because its mutability is questionable
+        metadata = dict(metadata or {})
+
+        # Make counts opt-in
+        show_counts = utils.is_truthy(self.context['request'].query_params.get('related_counts', False))
+        # Only include counts on detail routes
+        is_detail = self.context.get('view') and not isinstance(self.context['view'], generics.ListAPIView)
+        # Weird hack to avoid being called twice
+        # get_meta_information is called with both self.related_meta and self.self_meta.
+        # `is` could probably be used here but this seems more comprehensive.
+        is_related_meta = metadata.pop('include_state_counts', False)
+
+        if show_counts and is_detail and is_related_meta:
+            # Finally, require users to have view_actions permissions
+            auth = utils.get_user_auth(self.context['request'])
+            if auth and auth.logged_in and auth.user.has_perm('view_actions', provider):
+                metadata.update(provider.get_reviewable_state_counts())
+
+        return super(ReviewableCountsRelationshipField, self).get_meta_information(metadata, provider)
+
+
+class TargetRelationshipField(RelationshipField):
+    def get_object(self, preprint_id):
+        return PreprintService.objects.get(guids___id=preprint_id)
+
+    def to_internal_value(self, data):
+        preprint = self.get_object(data)
+        return {'target': preprint}
+
+
+class ActionSerializer(JSONAPISerializer):
+    filterable_fields = frozenset([
+        'id',
+        'trigger',
+        'from_state',
+        'to_state',
+        'date_created',
+        'date_modified',
+        'provider',
+        'target',
+    ])
+
+    id = ser.CharField(source='_id', read_only=True)
+
+    trigger = ser.ChoiceField(choices=Triggers.choices())
+
+    comment = HideIfProviderCommentsPrivate(ser.CharField(max_length=65535, required=False))
+
+    from_state = ser.ChoiceField(choices=States.choices(), read_only=True)
+    to_state = ser.ChoiceField(choices=States.choices(), read_only=True)
+
+    date_created = ser.DateTimeField(read_only=True)
+    date_modified = ser.DateTimeField(read_only=True)
+
+    provider = RelationshipField(
+        read_only=True,
+        related_view='preprint_providers:preprint_provider-detail',
+        related_view_kwargs={'provider_id': '<target.provider._id>'},
+        filter_key='target__provider___id',
+    )
+
+    target = TargetRelationshipField(
+        read_only=False,
+        required=True,
+        related_view='preprints:preprint-detail',
+        related_view_kwargs={'preprint_id': '<target._id>'},
+        filter_key='target__guids___id',
+    )
+
+    creator = HideIfProviderCommentsAnonymous(RelationshipField(
+        read_only=True,
+        related_view='users:user-detail',
+        related_view_kwargs={'user_id': '<creator._id>'},
+        filter_key='creator__guids___id',
+        always_embed=True,
+    ))
+
+    links = LinksField(
+        {
+            'self': 'get_action_url',
+        }
+    )
+
+    def get_absolute_url(self, obj):
+        return self.get_action_url(obj)
+
+    def get_action_url(self, obj):
+        return utils.absolute_reverse('actions:action-detail', kwargs={'action_id': obj._id, 'version': self.context['request'].parser_context['kwargs']['version']})
+
+    def create(self, validated_data):
+        trigger = validated_data.pop('trigger')
+        user = validated_data.pop('user')
+        target = validated_data.pop('target')
+        comment = validated_data.pop('comment', '')
+        try:
+            if trigger == Triggers.ACCEPT.value:
+                return target.reviews_accept(user, comment)
+            if trigger == Triggers.REJECT.value:
+                return target.reviews_reject(user, comment)
+            if trigger == Triggers.EDIT_COMMENT.value:
+                return target.reviews_edit_comment(user, comment)
+            if trigger == Triggers.SUBMIT.value:
+                return target.reviews_submit(user)
+        except InvalidTriggerError as e:
+            # Invalid transition from the current state
+            raise Conflict(e.message)
+        else:
+            raise JSONAPIAttributeException(attribute='trigger', detail='Invalid trigger.')
+
+    class Meta:
+        type_ = 'actions'

api/actions/urls.py

@@ -0,0 +1,8 @@
+from django.conf.urls import url
+
+from . import views
+
+urlpatterns = [
+    url(r'^$', views.CreateAction.as_view(), name=views.CreateAction.view_name),
+    url(r'^(?P<action_id>\w+)/$', views.ActionDetail.as_view(), name=views.ActionDetail.view_name),
+]

api/actions/views.py

@@ -0,0 +1,184 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.shortcuts import get_object_or_404
+from rest_framework import generics
+from rest_framework import permissions
+
+from framework.auth.oauth_scopes import CoreScopes
+from osf.models import Action
+from reviews import permissions as reviews_permissions
+
+from api.actions.serializers import ActionSerializer
+from api.base.exceptions import Conflict
+from api.base.parsers import (
+    JSONAPIMultipleRelationshipsParser,
+    JSONAPIMultipleRelationshipsParserForRegularJSON,
+)
+from api.base.utils import absolute_reverse
+from api.base.views import JSONAPIBaseView
+from api.base import permissions as base_permissions
+
+
+def get_actions_queryset():
+    return Action.objects.include(
+        'creator',
+        'creator__guids',
+        'target',
+        'target__guids',
+        'target__provider',
+    ).filter(is_deleted=False)
+
+
+class ActionDetail(JSONAPIBaseView, generics.RetrieveAPIView):
+    """Action Detail
+
+    Actions represent state changes and/or comments on a reviewable object (e.g. a preprint)
+
+    ##Action Attributes
+
+        name                            type                                description
+        ====================================================================================
+        date_created                    iso8601 timestamp                   timestamp that the action was created
+        date_modified                   iso8601 timestamp                   timestamp that the action was last modified
+        from_state                      string                              state of the reviewable before this action was created
+        to_state                        string                              state of the reviewable after this action was created
+        comment                         string                              comment explaining the state change
+        trigger                         string                              name of the trigger for this action
+
+    ##Relationships
+
+    ###Target
+    Link to the object (e.g. preprint) this action acts on
+
+    ###Provider
+    Link to detail for the target object's provider
+
+    ###Creator
+    Link to the user that created this action
+
+    ##Links
+    - `self` -- Detail page for the current action
+    """
+    permission_classes = (
+        permissions.IsAuthenticatedOrReadOnly,
+        base_permissions.TokenHasScope,
+        reviews_permissions.ActionPermission,
+    )
+
+    required_read_scopes = [CoreScopes.ACTIONS_READ]
+    required_write_scopes = [CoreScopes.ACTIONS_WRITE]
+
+    serializer_class = ActionSerializer
+    view_category = 'actions'
+    view_name = 'action-detail'
+
+    def get_object(self):
+        action = get_object_or_404(get_actions_queryset(), _id=self.kwargs['action_id'])
+        self.check_object_permissions(self.request, action)
+        return action
+
+
+class CreateAction(JSONAPIBaseView, generics.ListCreateAPIView):
+    """Create Actions *Write-only*
+
+    Use this endpoint to create a new Action and thereby trigger a state change on a preprint.
+
+    GETting from this endpoint will always return an empty list.
+    Use `/user/me/actions/` or `/preprints/<guid>/actions/` to read lists of actions.
+
+    ##Action Attributes
+
+        name                            type                                description
+        ====================================================================================
+        date_created                    iso8601 timestamp                   timestamp that the action was created
+        date_modified                   iso8601 timestamp                   timestamp that the action was last modified
+        from_state                      string                              state of the reviewable before this action was created
+        to_state                        string                              state of the reviewable after this action was created
+        comment                         string                              comment explaining the state change
+        trigger                         string                              name of the trigger for this action
+
+    ##Relationships
+
+    ###Target
+    Link to the object (e.g. preprint) this action acts on
+
+    ###Provider
+    Link to detail for the target object's provider
+
+    ###Creator
+    Link to the user that created this action
+
+    ##Links
+    - `self` -- Detail page for the current action
+
+    ##Query Params
+
+    + `page=<Int>` -- page number of results to view, default 1
+
+    + `filter[<fieldname>]=<Str>` -- fields and values to filter the search results on.
+
+    Actions may be filtered by their `id`, `from_state`, `to_state`, `date_created`, `date_modified`, `creator`, `provider`, `target`
+
+    ###Creating New Actions
+
+    Create a new Action by POSTing to `/actions/`, including the target preprint and the action trigger.
+
+    Valid triggers are: `submit`, `accept`, `reject`, and `edit_comment`
+
+        Method:        POST
+        URL:           /actions/
+        Query Params:  <none>
+        Body (JSON):   {
+                        "data": {
+                            "attributes": {
+                                "trigger": {trigger},           # required
+                                "comment": {comment},
+                            },
+                            "relationships": {
+                                "target": {                     # required
+                                    "data": {
+                                        "type": "preprints",
+                                        "id": {preprint_id}
+                                    }
+                                },
+                            }
+                        }
+                    }
+        Success:       201 CREATED + action representation
+    """
+    permission_classes = (
+        permissions.IsAuthenticatedOrReadOnly,
+        base_permissions.TokenHasScope,
+        reviews_permissions.ActionPermission,
+    )
+
+    required_read_scopes = [CoreScopes.NULL]
+    required_write_scopes = [CoreScopes.ACTIONS_WRITE]
+
+    parser_classes = (JSONAPIMultipleRelationshipsParser, JSONAPIMultipleRelationshipsParserForRegularJSON,)
+
+    serializer_class = ActionSerializer
+
+    view_category = 'actions'
+    view_name = 'create-action'
+
+    # overrides ListCreateAPIView
+    def perform_create(self, serializer):
+        target = serializer.validated_data['target']
+        self.check_object_permissions(self.request, target)
+
+        if not target.provider.is_reviewed:
+            raise Conflict('{} is an unmoderated provider. If you are an admin, set up moderation by setting `reviews_workflow` at {}'.format(
+                target.provider.name,
+                absolute_reverse('preprint_providers:preprint_provider-detail', kwargs={
+                    'provider_id': target.provider._id,
+                    'version': self.request.parser_context['kwargs']['version']
+                })
+            ))
+
+        serializer.save(user=self.request.user)
+
+    # overrides ListCreateAPIView
+    def get_queryset(self):
+        return Action.objects.none()

api/base/filters.py

@@ -4,6 +4,7 @@
 import re
 
 import pytz
+from guardian.shortcuts import get_objects_for_user
 from api.base import utils
 from api.base.exceptions import (InvalidFilterComparisonType,
                                  InvalidFilterError, InvalidFilterFieldError,
@@ -17,8 +18,9 @@
 from modularodm.query import queryset as modularodm_queryset
 from rest_framework import serializers as ser
 from rest_framework.filters import OrderingFilter
-from osf.models import Subject
+from osf.models import Subject, PreprintProvider
 from osf.models.base import GuidMixin
+from reviews.workflow import States
 
 
 def lowercase(lower):
@@ -494,3 +496,20 @@ def postprocess_query_param(self, key, field_name, operation):
             except Subject.DoesNotExist:
                 operation['source_field_name'] = 'subjects__text'
                 operation['op'] = 'iexact'
+
+    def preprints_queryset(self, base_queryset, auth_user, allow_contribs=True):
+        default_query = Q(node__isnull=False, node__is_deleted=False)
+        no_user_query = Q(is_published=True, node__is_public=True)
+
+        if auth_user:
+            admin_user_query = Q(node__contributor__user_id=auth_user.id, node__contributor__admin=True)
+            reviews_user_query = Q(node__is_public=True, provider__in=get_objects_for_user(auth_user, 'view_submissions', PreprintProvider))
+            if allow_contribs:
+                contrib_user_query = ~Q(reviews_state=States.INITIAL.value) & Q(node__contributor__user_id=auth_user.id, node__contributor__read=True)
+                query = default_query & (no_user_query | contrib_user_query | admin_user_query | reviews_user_query)
+            else:
+                query = default_query & (no_user_query | admin_user_query | reviews_user_query)
+        else:
+            query = default_query & no_user_query
+
+        return base_queryset.filter(query)