Add API for creating Assessments

client/hawc_client/assessment.py

@@ -1,3 +1,5 @@
+from requests import Response
+
 from .client import BaseClient
 
 
@@ -51,3 +53,44 @@ def all_values(self) -> list[dict]:
         """
         url = f"{self.session.root_url}/admin/api/reports/values/"
         return self.session.get(url).json()
+
+    def create(self, data: dict) -> dict:
+        """
+        Create an assessment.
+
+        Args:
+            data (dict): required metadata for creation
+
+        Returns:
+            dict: The resulting object, if create was successful
+        """
+        url = f"{self.session.root_url}/assessment/api/assessment/"
+        return self.session.post(url, data).json()
+
+    def update(self, assessment_id: int, data: dict) -> dict:
+        """
+        Update an existing assessment
+
+        Args:
+            assessment_id (int): assessment ID
+
+            data: fields to update in the assessment
+
+        Returns:
+            dict: The resulting object, if update was successful
+        """
+        url = f"{self.session.root_url}/assessment/api/assessment/{assessment_id}/"
+        return self.session.patch(url, data).json()
+
+    def delete(self, assessment_id: int) -> Response:
+        """
+        Delete a assessment
+
+        Args:
+            assessment_id (int): assessment ID
+
+        Returns:
+            Response: The response object.
+        """
+        url = f"{self.session.root_url}/assessment/api/assessment/{assessment_id}/"
+        return self.session.delete(url)

hawc/apps/assessment/api/viewsets.py

@@ -253,11 +253,17 @@ def get_queryset(self):
         return self.model.objects.all()
 
 
-class Assessment(AssessmentViewSet):
+class Assessment(AssessmentEditViewSet):
     model = models.Assessment
     serializer_class = serializers.AssessmentSerializer
     assessment_filter_args = "id"
 
+    def get_permissions(self):
+        if self.action in ["create", "update", "partial_update", "destroy"]:
+            return [permissions.IsAdminUser()]
+        else:
+            return super().get_permissions()
+
     @action(detail=False, permission_classes=(permissions.AllowAny,))
     def public(self, request):
         queryset = self.model.objects.all().public()

hawc/apps/assessment/serializers.py

@@ -21,8 +21,16 @@ class Meta:
 
 
 class AssessmentSerializer(serializers.ModelSerializer):
-    rob_name = serializers.CharField(source="get_rob_name_display")
-    dtxsids = DSSToxSerializer(many=True)
+    rob_name = serializers.CharField(source="get_rob_name_display", read_only=True)
+    dtxsids = DSSToxSerializer(many=True, read_only=True)
+    dtxsids_ids = serializers.PrimaryKeyRelatedField(
+        write_only=True,
+        many=True,
+        source="dtxsids",
+        queryset=models.DSSTox.objects.all(),
+        required=False,
+        allow_null=True,
+    )
 
     def to_representation(self, instance):
         ret = super().to_representation(instance)

tests/hawc/apps/assessment/test_api.py

@@ -175,3 +175,54 @@ def test_bad_request(self, db_keys):
         ]:
             resp = client.post(url, data, format="json")
             assert resp.status_code == code
+
+
+@pytest.mark.django_db
+class TestAssessmentCRUD:
+    def test_permissions(self, db_keys):
+        client = APIClient()
+        data = {
+            "name": "testing",
+            "year": "2013",
+            "version": "1",
+            "assessment_objective": "<p>Test.</p>",
+            "authors": "<p>Test.</p>",
+            "noel_name": 0,
+            "rob_name": 0,
+            "editable": "on",
+            "creator": 1,
+            "project_manager": [2],
+            "team_members": [1, 2],
+            "reviewers": [1],
+            "epi_version": 1,
+            "dtxsids_ids": ["DTXSID7020970"],
+        }
+
+        # test success
+        assert client.login(username="admin@hawcproject.org", password="pw") is True
+        resp = client.post(reverse("assessment:api:assessment-list"), data, format="json")
+        assert resp.status_code == 201
+
+        created_id = resp.json()["id"]
+        data.update(name="testing1")
+        resp = client.patch(reverse("assessment:api:assessment-detail", args=(created_id,)), data)
+        assert resp.status_code == 200
+
+        resp = client.delete(reverse("assessment:api:assessment-detail", args=(created_id,)))
+        assert resp.status_code == 204
+
+        # test failures
+        assert client.login(username="pm@hawcproject.org", password="pw") is True
+        resp = client.post(reverse("assessment:api:assessment-list"), data)
+        assert resp.status_code == 403
+
+        resp = client.patch(
+            reverse("assessment:api:assessment-detail", args=(db_keys.assessment_working,)), data
+        )
+        assert resp.status_code == 403
+
+        assert client.login(username="pm@hawcproject.org", password="pw") is True
+        resp = client.delete(
+            reverse("assessment:api:assessment-detail", args=(db_keys.assessment_working,))
+        )
+        assert resp.status_code == 403