Add endpoints to viewsets

src/openforms/forms/api/permissions.py

@@ -0,0 +1,12 @@
+from rest_framework.permissions import SAFE_METHODS, BasePermission
+
+
+class IsStaffOrReadOnly(BasePermission):
+    """
+    The request is a staff user, or is a read-only request.
+    """
+
+    def has_permission(self, request, view):
+        return request.method in SAFE_METHODS or (
+            request.user and request.user.is_staff
+        )

src/openforms/forms/api/serializers.py

@@ -1,4 +1,4 @@
-import json
+from django.shortcuts import get_object_or_404
 
 from rest_framework import serializers
 from rest_framework_nested.relations import NestedHyperlinkedRelatedField
@@ -83,14 +83,29 @@ class Meta:
         }
 
 
-class FormStepSerializer(serializers.ModelSerializer):
-    index = serializers.IntegerField(source="order")
-    configuration = serializers.JSONField(source="form_definition.configuration")
+class FormStepSerializer(serializers.HyperlinkedModelSerializer):
+    index = serializers.IntegerField(source="order", read_only=True)
+    configuration = serializers.JSONField(
+        source="form_definition.configuration", read_only=True
+    )
 
     parent_lookup_kwargs = {
         "form_uuid": "form__uuid",
     }
 
     class Meta:
         model = FormStep
-        fields = ("index", "configuration")
+        fields = ("index", "configuration", "form_definition")
+
+        extra_kwargs = {
+            "form_definition": {
+                "view_name": "api:formdefinition-detail",
+                "lookup_field": "uuid",
+            },
+        }
+
+    def create(self, validated_data):
+        validated_data["form"] = get_object_or_404(
+            Form, uuid=self.context["view"].kwargs["form_uuid"]
+        )
+        return super().create(validated_data)

src/openforms/forms/api/viewsets.py

@@ -2,14 +2,15 @@
 
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiParameter, extend_schema, extend_schema_view
-from rest_framework import permissions, status, viewsets
+from rest_framework import mixins, permissions, status, viewsets
 from rest_framework.decorators import action
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework_nested.viewsets import NestedViewSetMixin
 
 from openforms.api.pagination import PageNumberPagination
 
+from ..api.permissions import IsStaffOrReadOnly
 from ..api.serializers import (
     FormDefinitionSerializer,
     FormSerializer,
@@ -18,13 +19,6 @@
 from ..models import Form, FormDefinition, FormStep
 
 
-class BaseFormsViewSet(viewsets.ReadOnlyModelViewSet):
-    lookup_field = "uuid"
-    # anonymous clients must be able to get the form definitions in the browser
-    # The DRF settings apply some default throttling to mitigate abuse
-    permission_classes = [permissions.AllowAny]
-
-
 @extend_schema(
     parameters=[
         OpenApiParameter("form_uuid", OpenApiTypes.UUID, location=OpenApiParameter.PATH)
@@ -33,10 +27,19 @@ class BaseFormsViewSet(viewsets.ReadOnlyModelViewSet):
 @extend_schema_view(
     list=extend_schema(summary=_("List form steps")),
     retrieve=extend_schema(summary=_("Retrieve form step details")),
+    create=extend_schema(summary=_("Create a form step")),
+    update=extend_schema(summary=_("Update all details of a form step")),
+    partial_update=extend_schema(summary=_("Update some details of a form step")),
+    destroy=extend_schema(summary=_("Delete a form step")),
 )
-class FormStepViewSet(NestedViewSetMixin, BaseFormsViewSet):
+class FormStepViewSet(
+    NestedViewSetMixin,
+    viewsets.ModelViewSet,
+):
     serializer_class = FormStepSerializer
     queryset = FormStep.objects.all()
+    permission_classes = [IsStaffOrReadOnly]
+    lookup_field = "uuid"
 
 
 @extend_schema_view(
@@ -49,10 +52,14 @@ class FormStepViewSet(NestedViewSetMixin, BaseFormsViewSet):
         tags=["forms"],
     ),
 )
-class FormDefinitionViewSet(BaseFormsViewSet):
+class FormDefinitionViewSet(viewsets.ReadOnlyModelViewSet):
     queryset = FormDefinition.objects.order_by("slug")
     serializer_class = FormDefinitionSerializer
     pagination_class = PageNumberPagination
+    lookup_field = "uuid"
+    # anonymous clients must be able to get the form definitions in the browser
+    # The DRF settings apply some default throttling to mitigate abuse
+    permission_classes = [permissions.AllowAny]
 
     def get_serializer_context(self) -> dict:
         context = super().get_serializer_context()
@@ -79,7 +86,14 @@ def configuration(self, request: Request, *args, **kwargs):
 @extend_schema_view(
     list=extend_schema(summary=_("List forms")),
     retrieve=extend_schema(summary=_("Retrieve form details")),
+    create=extend_schema(summary=_("Create form")),
+    update=extend_schema(summary=_("Update all details of a form")),
+    partial_update=extend_schema(summary=_("Update given details of a form")),
 )
-class FormViewSet(BaseFormsViewSet):
+class FormViewSet(
+    mixins.CreateModelMixin, mixins.UpdateModelMixin, viewsets.ReadOnlyModelViewSet
+):
     queryset = Form.objects.filter(active=True)
+    lookup_field = "uuid"
     serializer_class = FormSerializer
+    permission_classes = [IsStaffOrReadOnly]