fix permissions on tags

ipynbsrv/api/serializer.py

@@ -52,24 +52,23 @@ class FlatBackendUserSerializer(serializers.ModelSerializer):
     """
     Todo: write doc.
     """
-    username = serializers.CharField(source='get_username')
     collab_group = FlatCollaborationGroupSerializer(source='get_collaboration_group')
 
     class Meta:
         model = BackendUser
-        fields = ('id', 'username', 'collab_group')
+        fields = ('id', 'collab_group',)
 
 
 class UserSerializer(serializers.ModelSerializer):
     """
     Todo: write doc.
     """
-    backend_user = FlatBackendUserSerializer()
+    backend_user = FlatBackendUserSerializer(read_only=True, many=False)
 
     class Meta:
         model = User
-        fields = ('id', 'username', 'backend_user')
-        read_only_fields = ('id', 'username', )
+        fields = ('id', 'username', 'backend_user', 'is_active', 'is_staff')
+        read_only_fields = ('id', 'username', 'backend_user', 'is_staff')
 
 
 class NestedBackendUserSerializer(serializers.ModelSerializer):

ipynbsrv/api/views.py

@@ -84,7 +84,7 @@ class UserList(generics.ListAPIView):
     permission_classes = [IsSuperUserOrReadOnly]
 
 
-class UserDetails(generics.RetrieveAPIView):
+class UserDetails(generics.RetrieveUpdateDestroyAPIView):
     """
     Get a list of all users (`django.contrib.auth.models.User`).
     Only visible to authenticated users.
@@ -802,10 +802,13 @@ def get_queryset(self):
         return queryset
 
 
-class TagDetail(generics.RetrieveUpdateDestroyAPIView):
+class TagDetail(generics.RetrieveDestroyAPIView):
     """
     Get details of a tag.
     """
+
+    permission_classes = [IsSuperUserOrReadOnly]
+
     queryset = Tag.objects.all()
     serializer_class = TagSerializer