specific endpoints list depending on user permissions

ipynbsrv/api/permissions.py

@@ -84,14 +84,24 @@ def has_object_permission(self, request, view, obj):
 
 class IsSuperUserOrReadOnly(
         permissions.BasePermission,
+        IsAuthenticatedMixin,
         IsSuperUserMixin,
         IsSafeMethodMixin):
 
+    def has_permission(self, request, view):
+        if self.is_authenticated(request):
+            if self.is_safe_method(request):
+                return True
+            if self.is_superuser(request.user):
+                return True
+        return False
+
     def has_object_permission(self, request, view, obj):
-        if self.is_safe_method(request):
-            return True
-        if self.is_superuser(request.user):
-            return True
+        if self.is_authenticated(request):
+            if self.is_safe_method(request):
+                return True
+            if self.is_superuser(request.user):
+                return True
         return False
 
 

ipynbsrv/api/views.py

@@ -30,20 +30,25 @@ def api_root(request, format=None):
     """
     API Root
     """
-    return Response({'endpoints': {
-        'configurationvariables': 'desc',
-        'users': 'desc',
-        'collaborationgroups': 'desc',
-        'backends': 'desc',
-        'containers': 'desc',
-        'images': 'desc',
-        'snapshots': 'desc',
-        'servers': 'desc',
-        'shares': 'desc',
-        'tags': 'desc',
-        'notifications': 'desc',
-        'notificationlogs': 'desc',
-    }})
+    available_endpoints = {}
+    available_endpoints['users'] = 'desc'
+    available_endpoints['collaborationgroups'] = 'desc'
+    available_endpoints['containers'] = 'desc'
+    available_endpoints['images'] = 'desc'
+    available_endpoints['snapshots'] = 'desc'
+    available_endpoints['shares'] = 'desc'
+    available_endpoints['tags'] = 'desc'
+    available_endpoints['notifications'] = 'desc'
+    available_endpoints['notificationlogs'] = 'desc'
+    available_endpoints['notificationtypes'] = 'desc'
+
+    # additional endpoints for superusers only
+    if request.user.is_superuser:
+        available_endpoints['configurationvariables'] = 'desc'
+        available_endpoints['backends'] = 'desc'
+        available_endpoints['servers'] = 'desc'
+
+    return Response(available_endpoints)
 
 
 class ConfigurationVariableList(generics.ListCreateAPIView):