Added rest framework

thirdpart/rest_framework/__init__.py

@@ -0,0 +1,3 @@
+__version__ = '2.1.6'
+
+VERSION = __version__  # synonym

thirdpart/rest_framework/authentication.py

@@ -0,0 +1,125 @@
+"""
+Provides a set of pluggable authentication policies.
+"""
+
+from django.contrib.auth import authenticate
+from django.utils.encoding import smart_unicode, DjangoUnicodeDecodeError
+from rest_framework import exceptions
+from rest_framework.compat import CsrfViewMiddleware
+from rest_framework.authtoken.models import Token
+import base64
+
+
+class BaseAuthentication(object):
+    """
+    All authentication classes should extend BaseAuthentication.
+    """
+
+    def authenticate(self, request):
+        """
+        Authenticate the request and return a two-tuple of (user, token).
+        """
+        raise NotImplementedError(".authenticate() must be overridden.")
+
+
+class BasicAuthentication(BaseAuthentication):
+    """
+    HTTP Basic authentication against username/password.
+    """
+
+    def authenticate(self, request):
+        """
+        Returns a `User` if a correct username and password have been supplied
+        using HTTP Basic authentication.  Otherwise returns `None`.
+        """
+        if 'HTTP_AUTHORIZATION' in request.META:
+            auth = request.META['HTTP_AUTHORIZATION'].split()
+            if len(auth) == 2 and auth[0].lower() == "basic":
+                try:
+                    auth_parts = base64.b64decode(auth[1]).partition(':')
+                except TypeError:
+                    return None
+
+                try:
+                    userid = smart_unicode(auth_parts[0])
+                    password = smart_unicode(auth_parts[2])
+                except DjangoUnicodeDecodeError:
+                    return None
+
+                return self.authenticate_credentials(userid, password)
+
+    def authenticate_credentials(self, userid, password):
+        """
+        Authenticate the userid and password against username and password.
+        """
+        user = authenticate(username=userid, password=password)
+        if user is not None and user.is_active:
+            return (user, None)
+
+
+class SessionAuthentication(BaseAuthentication):
+    """
+    Use Django's session framework for authentication.
+    """
+
+    def authenticate(self, request):
+        """
+        Returns a `User` if the request session currently has a logged in user.
+        Otherwise returns `None`.
+        """
+
+        # Get the underlying HttpRequest object
+        http_request = request._request
+        user = getattr(http_request, 'user', None)
+
+        # Unauthenticated, CSRF validation not required
+        if not user or not user.is_active:
+            return
+
+        # Enforce CSRF validation for session based authentication.
+        class CSRFCheck(CsrfViewMiddleware):
+            def _reject(self, request, reason):
+                # Return the failure reason instead of an HttpResponse
+                return reason
+
+        reason = CSRFCheck().process_view(http_request, None, (), {})
+        if reason:
+            # CSRF failed, bail with explicit error message
+            raise exceptions.PermissionDenied('CSRF Failed: %s' % reason)
+
+        # CSRF passed with authenticated user
+        return (user, None)
+
+
+class TokenAuthentication(BaseAuthentication):
+    """
+    Simple token based authentication.
+
+    Clients should authenticate by passing the token key in the "Authorization"
+    HTTP header, prepended with the string "Token ".  For example:
+
+        Authorization: Token 401f7ac837da42b97f613d789819ff93537bee6a
+    """
+
+    model = Token
+    """
+    A custom token model may be used, but must have the following properties.
+
+    * key -- The string identifying the token
+    * user -- The user to which the token belongs
+    """
+
+    def authenticate(self, request):
+        auth = request.META.get('HTTP_AUTHORIZATION', '').split()
+
+        if len(auth) == 2 and auth[0].lower() == "token":
+            key = auth[1]
+            try:
+                token = self.model.objects.get(key=key)
+            except self.model.DoesNotExist:
+                return None
+
+            if token.user.is_active:
+                return (token.user, token)
+
+# TODO: OAuthAuthentication

thirdpart/rest_framework/authtoken/migrations/0001_initial.py

@@ -0,0 +1,78 @@
+# -*- coding: utf-8 -*-
+import datetime
+from south.db import db
+from south.v2 import SchemaMigration
+from django.db import models
+
+
+try:
+    from django.contrib.auth import get_user_model
+except ImportError: # django < 1.5
+    from django.contrib.auth.models import User
+else:
+    User = get_user_model()
+
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        # Adding model 'Token'
+        db.create_table('authtoken_token', (
+            ('key', self.gf('django.db.models.fields.CharField')(max_length=40, primary_key=True)),
+            ('user', self.gf('django.db.models.fields.related.OneToOneField')(related_name='auth_token', unique=True, to=orm['%s.%s' % (User._meta.app_label, User._meta.object_name)])),
+            ('created', self.gf('django.db.models.fields.DateTimeField')(auto_now_add=True, blank=True)),
+        ))
+        db.send_create_signal('authtoken', ['Token'])
+
+
+    def backwards(self, orm):
+        # Deleting model 'Token'
+        db.delete_table('authtoken_token')
+
+
+    models = {
+        'auth.group': {
+            'Meta': {'object_name': 'Group'},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}),
+            'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'})
+        },
+        'auth.permission': {
+            'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'},
+            'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '50'})
+        },
+        "%s.%s" % (User._meta.app_label, User._meta.module_name): {
+            'Meta': {'object_name': 'User'},
+            'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}),
+            'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'groups': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Group']", 'symmetrical': 'False', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}),
+            'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}),
+            'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'})
+        },
+        'authtoken.token': {
+            'Meta': {'object_name': 'Token'},
+            'created': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'blank': 'True'}),
+            'key': ('django.db.models.fields.CharField', [], {'max_length': '40', 'primary_key': 'True'}),
+            'user': ('django.db.models.fields.related.OneToOneField', [], {'related_name': "'auth_token'", 'unique': 'True', 'to': "orm['%s.%s']" % (User._meta.app_label, User._meta.object_name)})
+        },
+        'contenttypes.contenttype': {
+            'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"},
+            'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '100'})
+        }
+    }
+
+    complete_apps = ['authtoken']

thirdpart/rest_framework/authtoken/models.py

@@ -0,0 +1,26 @@
+import uuid
+import hmac
+from hashlib import sha1
+from rest_framework.compat import User
+from django.db import models
+
+
+class Token(models.Model):
+    """
+    The default authorization token model.
+    """
+    key = models.CharField(max_length=40, primary_key=True)
+    user = models.OneToOneField(User, related_name='auth_token')
+    created = models.DateTimeField(auto_now_add=True)
+
+    def save(self, *args, **kwargs):
+        if not self.key:
+            self.key = self.generate_key()
+        return super(Token, self).save(*args, **kwargs)
+
+    def generate_key(self):
+        unique = str(uuid.uuid4())
+        return hmac.new(unique, digestmod=sha1).hexdigest()
+
+    def __unicode__(self):
+        return self.key

thirdpart/rest_framework/authtoken/serializers.py

@@ -0,0 +1,24 @@
+from django.contrib.auth import authenticate
+from rest_framework import serializers
+
+class AuthTokenSerializer(serializers.Serializer):
+    username = serializers.CharField()
+    password = serializers.CharField()
+
+    def validate(self, attrs):
+        username = attrs.get('username')
+        password = attrs.get('password')
+
+        if username and password:
+            user = authenticate(username=username, password=password)
+
+            if user:
+                if not user.is_active:
+                    raise serializers.ValidationError('User account is disabled.')
+                attrs['user'] = user
+                return attrs
+            else:
+                raise serializers.ValidationError('Unable to login with provided credentials.')
+        else:
+            raise serializers.ValidationError('Must include "username" and "password"')
+

thirdpart/rest_framework/authtoken/views.py

@@ -0,0 +1,24 @@
+from rest_framework.views import APIView
+from rest_framework import status
+from rest_framework import parsers
+from rest_framework import renderers
+from rest_framework.response import Response
+from rest_framework.authtoken.models import Token
+from rest_framework.authtoken.serializers import AuthTokenSerializer
+
+class ObtainAuthToken(APIView):
+    throttle_classes = ()
+    permission_classes = ()
+    parser_classes = (parsers.FormParser, parsers.MultiPartParser, parsers.JSONParser,)
+    renderer_classes = (renderers.JSONRenderer,) 
+    model = Token
+
+    def post(self, request):
+        serializer = AuthTokenSerializer(data=request.DATA)
+        if serializer.is_valid():
+            token, created = Token.objects.get_or_create(user=serializer.object['user'])
+            return Response({'token': token.key})
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+
+obtain_auth_token = ObtainAuthToken.as_view()

thirdpart/rest_framework/compat.py

@@ -0,0 +1,376 @@
+"""
+The `compat` module provides support for backwards compatibility with older
+versions of django/python, and compatibility wrappers around optional packages.
+"""
+# flake8: noqa
+import django
+
+# django-filter is optional
+try:
+    import django_filters
+except:
+    django_filters = None
+
+
+# cStringIO only if it's available, otherwise StringIO
+try:
+    import cStringIO as StringIO
+except ImportError:
+    import StringIO
+
+
+def get_concrete_model(model_cls):
+    try:
+        return model_cls._meta.concrete_model
+    except AttributeError:
+        # 1.3 does not include concrete model
+        return model_cls
+
+
+# Django 1.5 add support for custom auth user model
+if django.VERSION >= (1, 5):
+    from django.conf import settings
+    if hasattr(settings, 'AUTH_USER_MODEL'):
+        User = settings.AUTH_USER_MODEL
+    else:
+        from django.contrib.auth.models import User
+else:
+    try:
+        from django.contrib.auth.models import User
+    except ImportError:
+        raise ImportError(u"User model is not to be found.")
+
+
+# First implementation of Django class-based views did not include head method
+# in base View class - https://code.djangoproject.com/ticket/15668
+if django.VERSION >= (1, 4):
+    from django.views.generic import View
+else:
+    from django.views.generic import View as _View
+    from django.utils.decorators import classonlymethod
+    from django.utils.functional import update_wrapper
+
+    class View(_View):
+        @classonlymethod
+        def as_view(cls, **initkwargs):
+            """
+            Main entry point for a request-response process.
+            """
+            # sanitize keyword arguments
+            for key in initkwargs:
+                if key in cls.http_method_names:
+                    raise TypeError(u"You tried to pass in the %s method name as a "
+                                    u"keyword argument to %s(). Don't do that."
+                                    % (key, cls.__name__))
+                if not hasattr(cls, key):
+                    raise TypeError(u"%s() received an invalid keyword %r" % (
+                        cls.__name__, key))
+
+            def view(request, *args, **kwargs):
+                self = cls(**initkwargs)
+                if hasattr(self, 'get') and not hasattr(self, 'head'):
+                    self.head = self.get
+                return self.dispatch(request, *args, **kwargs)
+
+            # take name and docstring from class
+            update_wrapper(view, cls, updated=())
+
+            # and possible attributes set by decorators
+            # like csrf_exempt from dispatch
+            update_wrapper(view, cls.dispatch, assigned=())
+            return view
+
+# PUT, DELETE do not require CSRF until 1.4.  They should.  Make it better.
+if django.VERSION >= (1, 4):
+    from django.middleware.csrf import CsrfViewMiddleware
+else:
+    import hashlib
+    import re
+    import random
+    import logging
+    import urlparse
+
+    from django.conf import settings
+    from django.core.urlresolvers import get_callable
+
+    try:
+        from logging import NullHandler
+    except ImportError:
+        class NullHandler(logging.Handler):
+            def emit(self, record):
+                pass
+
+    logger = logging.getLogger('django.request')
+
+    if not logger.handlers:
+        logger.addHandler(NullHandler())
+
+    def same_origin(url1, url2):
+        """
+        Checks if two URLs are 'same-origin'
+        """
+        p1, p2 = urlparse.urlparse(url1), urlparse.urlparse(url2)
+        return p1[0:2] == p2[0:2]
+
+    def constant_time_compare(val1, val2):
+        """
+        Returns True if the two strings are equal, False otherwise.
+
+        The time taken is independent of the number of characters that match.
+        """
+        if len(val1) != len(val2):
+            return False
+        result = 0
+        for x, y in zip(val1, val2):
+            result |= ord(x) ^ ord(y)
+        return result == 0
+
+    # Use the system (hardware-based) random number generator if it exists.
+    if hasattr(random, 'SystemRandom'):
+        randrange = random.SystemRandom().randrange
+    else:
+        randrange = random.randrange
+    _MAX_CSRF_KEY = 18446744073709551616L     # 2 << 63
+
+    REASON_NO_REFERER = "Referer checking failed - no Referer."
+    REASON_BAD_REFERER = "Referer checking failed - %s does not match %s."
+    REASON_NO_CSRF_COOKIE = "CSRF cookie not set."
+    REASON_BAD_TOKEN = "CSRF token missing or incorrect."
+
+    def _get_failure_view():
+        """
+        Returns the view to be used for CSRF rejections
+        """
+        return get_callable(settings.CSRF_FAILURE_VIEW)
+
+    def _get_new_csrf_key():
+        return hashlib.md5("%s%s" % (randrange(0, _MAX_CSRF_KEY), settings.SECRET_KEY)).hexdigest()
+
+    def get_token(request):
+        """
+        Returns the the CSRF token required for a POST form. The token is an
+        alphanumeric value.
+
+        A side effect of calling this function is to make the the csrf_protect
+        decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
+        header to the outgoing response.  For this reason, you may need to use this
+        function lazily, as is done by the csrf context processor.
+        """
+        request.META["CSRF_COOKIE_USED"] = True
+        return request.META.get("CSRF_COOKIE", None)
+
+    def _sanitize_token(token):
+        # Allow only alphanum, and ensure we return a 'str' for the sake of the post
+        # processing middleware.
+        token = re.sub('[^a-zA-Z0-9]', '', str(token.decode('ascii', 'ignore')))
+        if token == "":
+            # In case the cookie has been truncated to nothing at some point.
+            return _get_new_csrf_key()
+        else:
+            return token
+
+    class CsrfViewMiddleware(object):
+        """
+        Middleware that requires a present and correct csrfmiddlewaretoken
+        for POST requests that have a CSRF cookie, and sets an outgoing
+        CSRF cookie.
+
+        This middleware should be used in conjunction with the csrf_token template
+        tag.
+        """
+        # The _accept and _reject methods currently only exist for the sake of the
+        # requires_csrf_token decorator.
+        def _accept(self, request):
+            # Avoid checking the request twice by adding a custom attribute to
+            # request.  This will be relevant when both decorator and middleware
+            # are used.
+            request.csrf_processing_done = True
+            return None
+
+        def _reject(self, request, reason):
+            return _get_failure_view()(request, reason=reason)
+
+        def process_view(self, request, callback, callback_args, callback_kwargs):
+
+            if getattr(request, 'csrf_processing_done', False):
+                return None
+
+            try:
+                csrf_token = _sanitize_token(request.COOKIES[settings.CSRF_COOKIE_NAME])
+                # Use same token next time
+                request.META['CSRF_COOKIE'] = csrf_token
+            except KeyError:
+                csrf_token = None
+                # Generate token and store it in the request, so it's available to the view.
+                request.META["CSRF_COOKIE"] = _get_new_csrf_key()
+
+            # Wait until request.META["CSRF_COOKIE"] has been manipulated before
+            # bailing out, so that get_token still works
+            if getattr(callback, 'csrf_exempt', False):
+                return None
+
+            # Assume that anything not defined as 'safe' by RC2616 needs protection.
+            if request.method not in ('GET', 'HEAD', 'OPTIONS', 'TRACE'):
+                if getattr(request, '_dont_enforce_csrf_checks', False):
+                    # Mechanism to turn off CSRF checks for test suite.  It comes after
+                    # the creation of CSRF cookies, so that everything else continues to
+                    # work exactly the same (e.g. cookies are sent etc), but before the
+                    # any branches that call reject()
+                    return self._accept(request)
+
+                if request.is_secure():
+                    # Suppose user visits http://example.com/
+                    # An active network attacker,(man-in-the-middle, MITM) sends a
+                    # POST form which targets https://example.com/detonate-bomb/ and
+                    # submits it via javascript.
+                    #
+                    # The attacker will need to provide a CSRF cookie and token, but
+                    # that is no problem for a MITM and the session independent
+                    # nonce we are using. So the MITM can circumvent the CSRF
+                    # protection. This is true for any HTTP connection, but anyone
+                    # using HTTPS expects better!  For this reason, for
+                    # https://example.com/ we need additional protection that treats
+                    # http://example.com/ as completely untrusted.  Under HTTPS,
+                    # Barth et al. found that the Referer header is missing for
+                    # same-domain requests in only about 0.2% of cases or less, so
+                    # we can use strict Referer checking.
+                    referer = request.META.get('HTTP_REFERER')
+                    if referer is None:
+                        logger.warning('Forbidden (%s): %s' % (REASON_NO_REFERER, request.path),
+                            extra={
+                                'status_code': 403,
+                                'request': request,
+                            }
+                        )
+                        return self._reject(request, REASON_NO_REFERER)
+
+                    # Note that request.get_host() includes the port
+                    good_referer = 'https://%s/' % request.get_host()
+                    if not same_origin(referer, good_referer):
+                        reason = REASON_BAD_REFERER % (referer, good_referer)
+                        logger.warning('Forbidden (%s): %s' % (reason, request.path),
+                            extra={
+                                'status_code': 403,
+                                'request': request,
+                            }
+                        )
+                        return self._reject(request, reason)
+
+                if csrf_token is None:
+                    # No CSRF cookie. For POST requests, we insist on a CSRF cookie,
+                    # and in this way we can avoid all CSRF attacks, including login
+                    # CSRF.
+                    logger.warning('Forbidden (%s): %s' % (REASON_NO_CSRF_COOKIE, request.path),
+                        extra={
+                            'status_code': 403,
+                            'request': request,
+                        }
+                    )
+                    return self._reject(request, REASON_NO_CSRF_COOKIE)
+
+                # check non-cookie token for match
+                request_csrf_token = ""
+                if request.method == "POST":
+                    request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
+
+                if request_csrf_token == "":
+                    # Fall back to X-CSRFToken, to make things easier for AJAX,
+                    # and possible for PUT/DELETE
+                    request_csrf_token = request.META.get('HTTP_X_CSRFTOKEN', '')
+
+                if not constant_time_compare(request_csrf_token, csrf_token):
+                    logger.warning('Forbidden (%s): %s' % (REASON_BAD_TOKEN, request.path),
+                        extra={
+                            'status_code': 403,
+                            'request': request,
+                        }
+                    )
+                    return self._reject(request, REASON_BAD_TOKEN)
+
+            return self._accept(request)
+
+# timezone support is new in Django 1.4
+try:
+    from django.utils import timezone
+except ImportError:
+    timezone = None
+
+# dateparse is ALSO new in Django 1.4
+try:
+    from django.utils.dateparse import parse_date, parse_datetime
+except ImportError:
+    import datetime
+    import re
+
+    date_re = re.compile(
+        r'(?P<year>\d{4})-(?P<month>\d{1,2})-(?P<day>\d{1,2})$'
+    )
+
+    datetime_re = re.compile(
+        r'(?P<year>\d{4})-(?P<month>\d{1,2})-(?P<day>\d{1,2})'
+        r'[T ](?P<hour>\d{1,2}):(?P<minute>\d{1,2})'
+        r'(?::(?P<second>\d{1,2})(?:\.(?P<microsecond>\d{1,6})\d{0,6})?)?'
+        r'(?P<tzinfo>Z|[+-]\d{1,2}:\d{1,2})?$'
+    )
+
+    time_re = re.compile(
+        r'(?P<hour>\d{1,2}):(?P<minute>\d{1,2})'
+        r'(?::(?P<second>\d{1,2})(?:\.(?P<microsecond>\d{1,6})\d{0,6})?)?'
+    )
+
+    def parse_date(value):
+        match = date_re.match(value)
+        if match:
+            kw = dict((k, int(v)) for k, v in match.groupdict().iteritems())
+            return datetime.date(**kw)
+
+    def parse_time(value):
+        match = time_re.match(value)
+        if match:
+            kw = match.groupdict()
+            if kw['microsecond']:
+                kw['microsecond'] = kw['microsecond'].ljust(6, '0')
+            kw = dict((k, int(v)) for k, v in kw.iteritems() if v is not None)
+            return datetime.time(**kw)
+
+    def parse_datetime(value):
+        """Parse datetime, but w/o the timezone awareness in 1.4"""
+        match = datetime_re.match(value)
+        if match:
+            kw = match.groupdict()
+            if kw['microsecond']:
+                kw['microsecond'] = kw['microsecond'].ljust(6, '0')
+            kw = dict((k, int(v)) for k, v in kw.iteritems() if v is not None)
+            return datetime.datetime(**kw)
+
+# Markdown is optional
+try:
+    import markdown
+
+    def apply_markdown(text):
+        """
+        Simple wrapper around :func:`markdown.markdown` to set the base level
+        of '#' style headers to <h2>.
+        """
+
+        extensions = ['headerid(level=2)']
+        safe_mode = False
+        md = markdown.Markdown(extensions=extensions, safe_mode=safe_mode)
+        return md.convert(text)
+
+except ImportError:
+    apply_markdown = None
+
+
+# Yaml is optional
+try:
+    import yaml
+except ImportError:
+    yaml = None
+
+
+# xml.etree.parse only throws ParseError for python >= 2.7
+try:
+    from xml.etree import ParseError as ETParseError
+except ImportError:  # python < 2.7
+    ETParseError = None

thirdpart/rest_framework/decorators.py

@@ -0,0 +1,88 @@
+from rest_framework.views import APIView
+
+
+def api_view(http_method_names):
+
+    """
+    Decorator that converts a function-based view into an APIView subclass.
+    Takes a list of allowed methods for the view as an argument.
+    """
+
+    def decorator(func):
+
+        WrappedAPIView = type(
+            'WrappedAPIView',
+            (APIView,),
+            {'__doc__': func.__doc__}
+        )
+
+        # Note, the above allows us to set the docstring.
+        # It is the equivalent of:
+        #
+        #     class WrappedAPIView(APIView):
+        #         pass
+        #     WrappedAPIView.__doc__ = func.doc    <--- Not possible to do this
+
+        allowed_methods = set(http_method_names) | set(('options',))
+        WrappedAPIView.http_method_names = [method.lower() for method in allowed_methods]
+
+        def handler(self, *args, **kwargs):
+            return func(*args, **kwargs)
+
+        for method in http_method_names:
+            setattr(WrappedAPIView, method.lower(), handler)
+
+        WrappedAPIView.__name__ = func.__name__
+
+        WrappedAPIView.renderer_classes = getattr(func, 'renderer_classes',
+                                                  APIView.renderer_classes)
+
+        WrappedAPIView.parser_classes = getattr(func, 'parser_classes',
+                                                APIView.parser_classes)
+
+        WrappedAPIView.authentication_classes = getattr(func, 'authentication_classes',
+                                                        APIView.authentication_classes)
+
+        WrappedAPIView.throttle_classes = getattr(func, 'throttle_classes',
+                                                  APIView.throttle_classes)
+
+        WrappedAPIView.permission_classes = getattr(func, 'permission_classes',
+                                                    APIView.permission_classes)
+
+        return WrappedAPIView.as_view()
+    return decorator
+
+
+def renderer_classes(renderer_classes):
+    def decorator(func):
+        func.renderer_classes = renderer_classes
+        return func
+    return decorator
+
+
+def parser_classes(parser_classes):
+    def decorator(func):
+        func.parser_classes = parser_classes
+        return func
+    return decorator
+
+
+def authentication_classes(authentication_classes):
+    def decorator(func):
+        func.authentication_classes = authentication_classes
+        return func
+    return decorator
+
+
+def throttle_classes(throttle_classes):
+    def decorator(func):
+        func.throttle_classes = throttle_classes
+        return func
+    return decorator
+
+
+def permission_classes(permission_classes):
+    def decorator(func):
+        func.permission_classes = permission_classes
+        return func
+    return decorator

thirdpart/rest_framework/exceptions.py

@@ -0,0 +1,78 @@
+"""
+Handled exceptions raised by REST framework.
+
+In addition Django's built in 403 and 404 exceptions are handled.
+(`django.http.Http404` and `django.core.exceptions.PermissionDenied`)
+"""
+from rest_framework import status
+
+
+class APIException(Exception):
+    """
+    Base class for REST framework exceptions.
+    Subclasses should provide `.status_code` and `.detail` properties.
+    """
+    pass
+
+
+class ParseError(APIException):
+    status_code = status.HTTP_400_BAD_REQUEST
+    default_detail = 'Malformed request.'
+
+    def __init__(self, detail=None):
+        self.detail = detail or self.default_detail
+
+
+class PermissionDenied(APIException):
+    status_code = status.HTTP_403_FORBIDDEN
+    default_detail = 'You do not have permission to perform this action.'
+
+    def __init__(self, detail=None):
+        self.detail = detail or self.default_detail
+
+
+class MethodNotAllowed(APIException):
+    status_code = status.HTTP_405_METHOD_NOT_ALLOWED
+    default_detail = "Method '%s' not allowed."
+
+    def __init__(self, method, detail=None):
+        self.detail = (detail or self.default_detail) % method
+
+
+class NotAcceptable(APIException):
+    status_code = status.HTTP_406_NOT_ACCEPTABLE
+    default_detail = "Could not satisfy the request's Accept header"
+
+    def __init__(self, detail=None, available_renderers=None):
+        self.detail = detail or self.default_detail
+        self.available_renderers = available_renderers
+
+
+class UnsupportedMediaType(APIException):
+    status_code = status.HTTP_415_UNSUPPORTED_MEDIA_TYPE
+    default_detail = "Unsupported media type '%s' in request."
+
+    def __init__(self, media_type, detail=None):
+        self.detail = (detail or self.default_detail) % media_type
+
+
+class Throttled(APIException):
+    status_code = status.HTTP_429_TOO_MANY_REQUESTS
+    default_detail = "Request was throttled."
+    extra_detail = "Expected available in %d second%s."
+
+    def __init__(self, wait=None, detail=None):
+        import math
+        self.wait = wait and math.ceil(wait) or None
+        if wait is not None:
+            format = detail or self.default_detail + self.extra_detail
+            self.detail = format % (self.wait, self.wait != 1 and 's' or '')
+        else:
+            self.detail = detail or self.default_detail
+
+
+class ConfigurationError(Exception):
+    """
+    Indicates an internal server error.
+    """
+    pass

thirdpart/rest_framework/filters.py

@@ -0,0 +1,59 @@
+from rest_framework.compat import django_filters
+
+FilterSet = django_filters and django_filters.FilterSet or None
+
+
+class BaseFilterBackend(object):
+    """
+    A base class from which all filter backend classes should inherit.
+    """
+
+    def filter_queryset(self, request, queryset, view):
+        """
+        Return a filtered queryset.
+        """
+        raise NotImplementedError(".filter_queryset() must be overridden.")
+
+
+class DjangoFilterBackend(BaseFilterBackend):
+    """
+    A filter backend that uses django-filter.
+    """
+    default_filter_set = FilterSet
+
+    def __init__(self):
+        assert django_filters, 'Using DjangoFilterBackend, but django-filter is not installed'
+
+    def get_filter_class(self, view):
+        """
+        Return the django-filters `FilterSet` used to filter the queryset.
+        """
+        filter_class = getattr(view, 'filter_class', None)
+        filter_fields = getattr(view, 'filter_fields', None)
+        view_model = getattr(view, 'model', None)
+
+        if filter_class:
+            filter_model = filter_class.Meta.model
+
+            assert issubclass(filter_model, view_model), \
+                'FilterSet model %s does not match view model %s' % \
+                (filter_model, view_model)
+
+            return filter_class
+
+        if filter_fields:
+            class AutoFilterSet(self.default_filter_set):
+                class Meta:
+                    model = view_model
+                    fields = filter_fields
+            return AutoFilterSet
+
+        return None
+
+    def filter_queryset(self, request, queryset, view):
+        filter_class = self.get_filter_class(view)
+
+        if filter_class:
+            return filter_class(request.GET, queryset=queryset)
+
+        return queryset

thirdpart/rest_framework/generics.py

@@ -0,0 +1,215 @@
+"""
+Generic views that provide commonly needed behaviour.
+"""
+
+from rest_framework import views, mixins
+from rest_framework.settings import api_settings
+from django.views.generic.detail import SingleObjectMixin
+from django.views.generic.list import MultipleObjectMixin
+
+
+### Base classes for the generic views ###
+
+class GenericAPIView(views.APIView):
+    """
+    Base class for all other generic views.
+    """
+
+    model = None
+    serializer_class = None
+    model_serializer_class = api_settings.DEFAULT_MODEL_SERIALIZER_CLASS
+
+    def get_serializer_context(self):
+        """
+        Extra context provided to the serializer class.
+        """
+        return {
+            'request': self.request,
+            'format': self.format_kwarg,
+            'view': self
+        }
+
+    def get_serializer_class(self):
+        """
+        Return the class to use for the serializer.
+
+        Defaults to using `self.serializer_class`, falls back to constructing a
+        model serializer class using `self.model_serializer_class`, with
+        `self.model` as the model.
+        """
+        serializer_class = self.serializer_class
+
+        if serializer_class is None:
+            class DefaultSerializer(self.model_serializer_class):
+                class Meta:
+                    model = self.model
+            serializer_class = DefaultSerializer
+
+        return serializer_class
+
+    def get_serializer(self, instance=None, data=None, files=None):
+        """
+        Return the serializer instance that should be used for validating and
+        deserializing input, and for serializing output.
+        """
+        serializer_class = self.get_serializer_class()
+        context = self.get_serializer_context()
+        return serializer_class(instance, data=data, files=files, context=context)
+
+
+class MultipleObjectAPIView(MultipleObjectMixin, GenericAPIView):
+    """
+    Base class for generic views onto a queryset.
+    """
+
+    paginate_by = api_settings.PAGINATE_BY
+    paginate_by_param = api_settings.PAGINATE_BY_PARAM
+    pagination_serializer_class = api_settings.DEFAULT_PAGINATION_SERIALIZER_CLASS
+    filter_backend = api_settings.FILTER_BACKEND
+
+    def filter_queryset(self, queryset):
+        """
+        Given a queryset, filter it with whichever filter backend is in use.
+        """
+        if not self.filter_backend:
+            return queryset
+        backend = self.filter_backend()
+        return backend.filter_queryset(self.request, queryset, self)
+
+    def get_pagination_serializer(self, page=None):
+        """
+        Return a serializer instance to use with paginated data.
+        """
+        class SerializerClass(self.pagination_serializer_class):
+            class Meta:
+                object_serializer_class = self.get_serializer_class()
+
+        pagination_serializer_class = SerializerClass
+        context = self.get_serializer_context()
+        return pagination_serializer_class(instance=page, context=context)
+
+    def get_paginate_by(self, queryset):
+        """
+        Return the size of pages to use with pagination.
+        """
+        if self.paginate_by_param:
+            query_params = self.request.QUERY_PARAMS
+            try:
+                return int(query_params[self.paginate_by_param])
+            except (KeyError, ValueError):
+                pass
+        return self.paginate_by
+
+
+class SingleObjectAPIView(SingleObjectMixin, GenericAPIView):
+    """
+    Base class for generic views onto a model instance.
+    """
+
+    pk_url_kwarg = 'pk'  # Not provided in Django 1.3
+    slug_url_kwarg = 'slug'  # Not provided in Django 1.3
+    slug_field = 'slug'
+
+    def get_object(self, queryset=None):
+        """
+        Override default to add support for object-level permissions.
+        """
+        obj = super(SingleObjectAPIView, self).get_object(queryset)
+        if not self.has_permission(self.request, obj):
+            self.permission_denied(self.request)
+        return obj
+
+
+### Concrete view classes that provide method handlers ###
+### by composing the mixin classes with a base view.   ###
+
+
+class CreateAPIView(mixins.CreateModelMixin,
+                    GenericAPIView):
+
+    """
+    Concrete view for creating a model instance.
+    """
+    def post(self, request, *args, **kwargs):
+        return self.create(request, *args, **kwargs)
+
+
+class ListAPIView(mixins.ListModelMixin,
+                  MultipleObjectAPIView):
+    """
+    Concrete view for listing a queryset.
+    """
+    def get(self, request, *args, **kwargs):
+        return self.list(request, *args, **kwargs)
+
+
+class RetrieveAPIView(mixins.RetrieveModelMixin,
+                      SingleObjectAPIView):
+    """
+    Concrete view for retrieving a model instance.
+    """
+    def get(self, request, *args, **kwargs):
+        return self.retrieve(request, *args, **kwargs)
+
+
+class DestroyAPIView(mixins.DestroyModelMixin,
+                     SingleObjectAPIView):
+
+    """
+    Concrete view for deleting a model instance.
+    """
+    def delete(self, request, *args, **kwargs):
+        return self.destroy(request, *args, **kwargs)
+
+
+class UpdateAPIView(mixins.UpdateModelMixin,
+                    SingleObjectAPIView):
+
+    """
+    Concrete view for updating a model instance.
+    """
+    def put(self, request, *args, **kwargs):
+        return self.update(request, *args, **kwargs)
+
+
+class ListCreateAPIView(mixins.ListModelMixin,
+                        mixins.CreateModelMixin,
+                        MultipleObjectAPIView):
+    """
+    Concrete view for listing a queryset or creating a model instance.
+    """
+    def get(self, request, *args, **kwargs):
+        return self.list(request, *args, **kwargs)
+
+    def post(self, request, *args, **kwargs):
+        return self.create(request, *args, **kwargs)
+
+
+class RetrieveDestroyAPIView(mixins.RetrieveModelMixin,
+                             mixins.DestroyModelMixin,
+                             SingleObjectAPIView):
+    """
+    Concrete view for retrieving or deleting a model instance.
+    """
+    def get(self, request, *args, **kwargs):
+        return self.retrieve(request, *args, **kwargs)
+
+    def delete(self, request, *args, **kwargs):
+        return self.destroy(request, *args, **kwargs)
+
+
+class RetrieveUpdateDestroyAPIView(mixins.RetrieveModelMixin,
+                                   mixins.UpdateModelMixin,
+                                   mixins.DestroyModelMixin,
+                                   SingleObjectAPIView):
+    """
+    Concrete view for retrieving, updating or deleting a model instance.
+    """
+    def get(self, request, *args, **kwargs):
+        return self.retrieve(request, *args, **kwargs)
+
+    def put(self, request, *args, **kwargs):
+        return self.update(request, *args, **kwargs)
+
+    def delete(self, request, *args, **kwargs):
+        return self.destroy(request, *args, **kwargs)

thirdpart/rest_framework/mixins.py

@@ -0,0 +1,125 @@
+"""
+Basic building blocks for generic class based views.
+
+We don't bind behaviour to http method handlers yet,
+which allows mixin classes to be composed in interesting ways.
+"""
+from django.http import Http404
+from rest_framework import status
+from rest_framework.response import Response
+
+
+class CreateModelMixin(object):
+    """
+    Create a model instance.
+    Should be mixed in with any `BaseView`.
+    """
+    def create(self, request, *args, **kwargs):
+        serializer = self.get_serializer(data=request.DATA, files=request.FILES)
+        if serializer.is_valid():
+            self.pre_save(serializer.object)
+            self.object = serializer.save()
+            headers = self.get_success_headers(serializer.data)
+            return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+    def get_success_headers(self, data):
+        try:
+            return {'Location': data['url']}
+        except (TypeError, KeyError):
+            return {}
+
+    def pre_save(self, obj):
+        pass
+
+
+class ListModelMixin(object):
+    """
+    List a queryset.
+    Should be mixed in with `MultipleObjectAPIView`.
+    """
+    empty_error = u"Empty list and '%(class_name)s.allow_empty' is False."
+
+    def list(self, request, *args, **kwargs):
+        queryset = self.get_queryset()
+        self.object_list = self.filter_queryset(queryset)
+
+        # Default is to allow empty querysets.  This can be altered by setting
+        # `.allow_empty = False`, to raise 404 errors on empty querysets.
+        allow_empty = self.get_allow_empty()
+        if not allow_empty and not self.object_list:
+            class_name = self.__class__.__name__
+            error_msg = self.empty_error % {'class_name': class_name}
+            raise Http404(error_msg)
+
+        # Pagination size is set by the `.paginate_by` attribute,
+        # which may be `None` to disable pagination.
+        page_size = self.get_paginate_by(self.object_list)
+        if page_size:
+            packed = self.paginate_queryset(self.object_list, page_size)
+            paginator, page, queryset, is_paginated = packed
+            serializer = self.get_pagination_serializer(page)
+        else:
+            serializer = self.get_serializer(self.object_list)
+
+        return Response(serializer.data)
+
+
+class RetrieveModelMixin(object):
+    """
+    Retrieve a model instance.
+    Should be mixed in with `SingleObjectBaseView`.
+    """
+    def retrieve(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        serializer = self.get_serializer(self.object)
+        return Response(serializer.data)
+
+
+class UpdateModelMixin(object):
+    """
+    Update a model instance.
+    Should be mixed in with `SingleObjectBaseView`.
+    """
+    def update(self, request, *args, **kwargs):
+        try:
+            self.object = self.get_object()
+            created = False
+        except Http404:
+            self.object = None
+            created = True
+
+        serializer = self.get_serializer(self.object, data=request.DATA, files=request.FILES)
+
+        if serializer.is_valid():
+            self.pre_save(serializer.object)
+            self.object = serializer.save()
+            status_code = created and status.HTTP_201_CREATED or status.HTTP_200_OK
+            return Response(serializer.data, status=status_code)
+
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+    def pre_save(self, obj):
+        """
+        Set any attributes on the object that are implicit in the request.
+        """
+        # pk and/or slug attributes are implicit in the URL.
+        pk = self.kwargs.get(self.pk_url_kwarg, None)
+        if pk:
+            setattr(obj, 'pk', pk)
+
+        slug = self.kwargs.get(self.slug_url_kwarg, None)
+        if slug:
+            slug_field = self.get_slug_field()
+            setattr(obj, slug_field, slug)
+
+
+class DestroyModelMixin(object):
+    """
+    Destroy a model instance.
+    Should be mixed in with `SingleObjectBaseView`.
+    """
+    def destroy(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        self.object.delete()
+        return Response(status=status.HTTP_204_NO_CONTENT)

thirdpart/rest_framework/models.py

@@ -0,0 +1 @@
+# Just to keep things like ./manage.py test happy

thirdpart/rest_framework/negotiation.py

@@ -0,0 +1,82 @@
+from django.http import Http404
+from rest_framework import exceptions
+from rest_framework.settings import api_settings
+from rest_framework.utils.mediatypes import order_by_precedence, media_type_matches
+
+
+class BaseContentNegotiation(object):
+    def select_parser(self, request, parsers):
+        raise NotImplementedError('.select_parser() must be implemented')
+
+    def select_renderer(self, request, renderers, format_suffix=None):
+        raise NotImplementedError('.select_renderer() must be implemented')
+
+
+class DefaultContentNegotiation(BaseContentNegotiation):
+    settings = api_settings
+
+    def select_parser(self, request, parsers):
+        """
+        Given a list of parsers and a media type, return the appropriate
+        parser to handle the incoming request.
+        """
+        for parser in parsers:
+            if media_type_matches(parser.media_type, request.content_type):
+                return parser
+        return None
+
+    def select_renderer(self, request, renderers, format_suffix=None):
+        """
+        Given a request and a list of renderers, return a two-tuple of:
+        (renderer, media type).
+        """
+        # Allow URL style format override.  eg. "?format=json
+        format_query_param = self.settings.URL_FORMAT_OVERRIDE
+        format = format_suffix or request.GET.get(format_query_param)
+
+        if format:
+            renderers = self.filter_renderers(renderers, format)
+
+        accepts = self.get_accept_list(request)
+
+        # Check the acceptable media types against each renderer,
+        # attempting more specific media types first
+        # NB. The inner loop here isn't as bad as it first looks :)
+        #     Worst case is we're looping over len(accept_list) * len(self.renderers)
+        for media_type_set in order_by_precedence(accepts):
+            for renderer in renderers:
+                for media_type in media_type_set:
+                    if media_type_matches(renderer.media_type, media_type):
+                        # Return the most specific media type as accepted.
+                        if len(renderer.media_type) > len(media_type):
+                            # Eg client requests '*/*'
+                            # Accepted media type is 'application/json'
+                            return renderer, renderer.media_type
+                        else:
+                            # Eg client requests 'application/json; indent=8'
+                            # Accepted media type is 'application/json; indent=8'
+                            return renderer, media_type
+
+        raise exceptions.NotAcceptable(available_renderers=renderers)
+
+    def filter_renderers(self, renderers, format):
+        """
+        If there is a '.json' style format suffix, filter the renderers
+        so that we only negotiation against those that accept that format.
+        """
+        renderers = [renderer for renderer in renderers
+                     if renderer.format == format]
+        if not renderers:
+            raise Http404
+        return renderers
+
+    def get_accept_list(self, request):
+        """
+        Given the incoming request, return a tokenised list of media
+        type strings.
+
+        Allows URL style accept override.  eg. "?accept=application/json"
+        """
+        header = request.META.get('HTTP_ACCEPT', '*/*')
+        header = request.GET.get(self.settings.URL_ACCEPT_OVERRIDE, header)
+        return [token.strip() for token in header.split(',')]

thirdpart/rest_framework/pagination.py

@@ -0,0 +1,81 @@
+from rest_framework import serializers
+from rest_framework.templatetags.rest_framework import replace_query_param
+
+# TODO: Support URLconf kwarg-style paging
+
+
+class NextPageField(serializers.Field):
+    """
+    Field that returns a link to the next page in paginated results.
+    """
+    page_field = 'page'
+
+    def to_native(self, value):
+        if not value.has_next():
+            return None
+        page = value.next_page_number()
+        request = self.context.get('request')
+        url = request and request.build_absolute_uri() or ''
+        return replace_query_param(url, self.page_field, page)
+
+
+class PreviousPageField(serializers.Field):
+    """
+    Field that returns a link to the previous page in paginated results.
+    """
+    page_field = 'page'
+
+    def to_native(self, value):
+        if not value.has_previous():
+            return None
+        page = value.previous_page_number()
+        request = self.context.get('request')
+        url = request and request.build_absolute_uri() or ''
+        return replace_query_param(url, self.page_field, page)
+
+
+class PaginationSerializerOptions(serializers.SerializerOptions):
+    """
+    An object that stores the options that may be provided to a
+    pagination serializer by using the inner `Meta` class.
+
+    Accessible on the instance as `serializer.opts`.
+    """
+    def __init__(self, meta):
+        super(PaginationSerializerOptions, self).__init__(meta)
+        self.object_serializer_class = getattr(meta, 'object_serializer_class',
+                                               serializers.Field)
+
+
+class BasePaginationSerializer(serializers.Serializer):
+    """
+    A base class for pagination serializers to inherit from,
+    to make implementing custom serializers more easy.
+    """
+    _options_class = PaginationSerializerOptions
+    results_field = 'results'
+
+    def __init__(self, *args, **kwargs):
+        """
+        Override init to add in the object serializer field on-the-fly.
+        """
+        super(BasePaginationSerializer, self).__init__(*args, **kwargs)
+        results_field = self.results_field
+        object_serializer = self.opts.object_serializer_class
+        self.fields[results_field] = object_serializer(source='object_list')
+
+    def to_native(self, obj):
+        """
+        Prevent default behaviour of iterating over elements, and serializing
+        each in turn.
+        """
+        return self.convert_object(obj)
+
+
+class PaginationSerializer(BasePaginationSerializer):
+    """
+    A default implementation of a pagination serializer.
+    """
+    count = serializers.Field(source='paginator.count')
+    next = NextPageField(source='*')
+    previous = PreviousPageField(source='*')

thirdpart/rest_framework/parsers.py

@@ -0,0 +1,189 @@
+"""
+Parsers are used to parse the content of incoming HTTP requests.
+
+They give us a generic way of being able to handle various media types
+on the request, such as form content or json encoded data.
+"""
+
+from django.http import QueryDict
+from django.http.multipartparser import MultiPartParser as DjangoMultiPartParser
+from django.http.multipartparser import MultiPartParserError
+from django.utils import simplejson as json
+from rest_framework.compat import yaml, ETParseError
+from rest_framework.exceptions import ParseError
+from xml.etree import ElementTree as ET
+from xml.parsers.expat import ExpatError
+import datetime
+import decimal
+
+
+class DataAndFiles(object):
+    def __init__(self, data, files):
+        self.data = data
+        self.files = files
+
+
+class BaseParser(object):
+    """
+    All parsers should extend `BaseParser`, specifying a `media_type`
+    attribute, and overriding the `.parse()` method.
+    """
+
+    media_type = None
+
+    def parse(self, stream, media_type=None, parser_context=None):
+        """
+        Given a stream to read from, return the parsed representation.
+        Should return parsed data, or a `DataAndFiles` object consisting of the
+        parsed data and files.
+        """
+        raise NotImplementedError(".parse() must be overridden.")
+
+
+class JSONParser(BaseParser):
+    """
+    Parses JSON-serialized data.
+    """
+
+    media_type = 'application/json'
+
+    def parse(self, stream, media_type=None, parser_context=None):
+        """
+        Returns a 2-tuple of `(data, files)`.
+
+        `data` will be an object which is the parsed content of the response.
+        `files` will always be `None`.
+        """
+        try:
+            return json.load(stream)
+        except ValueError, exc:
+            raise ParseError('JSON parse error - %s' % unicode(exc))
+
+
+class YAMLParser(BaseParser):
+    """
+    Parses YAML-serialized data.
+    """
+
+    media_type = 'application/yaml'
+
+    def parse(self, stream, media_type=None, parser_context=None):
+        """
+        Returns a 2-tuple of `(data, files)`.
+
+        `data` will be an object which is the parsed content of the response.
+        `files` will always be `None`.
+        """
+        try:
+            return yaml.safe_load(stream)
+        except (ValueError, yaml.parser.ParserError), exc:
+            raise ParseError('YAML parse error - %s' % unicode(exc))
+
+
+class FormParser(BaseParser):
+    """
+    Parser for form data.
+    """
+
+    media_type = 'application/x-www-form-urlencoded'
+
+    def parse(self, stream, media_type=None, parser_context=None):
+        """
+        Returns a 2-tuple of `(data, files)`.
+
+        `data` will be a :class:`QueryDict` containing all the form parameters.
+        `files` will always be :const:`None`.
+        """
+        data = QueryDict(stream.read())
+        return data
+
+
+class MultiPartParser(BaseParser):
+    """
+    Parser for multipart form data, which may include file data.
+    """
+
+    media_type = 'multipart/form-data'
+
+    def parse(self, stream, media_type=None, parser_context=None):
+        """
+        Returns a DataAndFiles object.
+
+        `.data` will be a `QueryDict` containing all the form parameters.
+        `.files` will be a `QueryDict` containing all the form files.
+        """
+        parser_context = parser_context or {}
+        request = parser_context['request']
+        meta = request.META
+        upload_handlers = request.upload_handlers
+
+        try:
+            parser = DjangoMultiPartParser(meta, stream, upload_handlers)
+            data, files = parser.parse()
+            return DataAndFiles(data, files)
+        except MultiPartParserError, exc:
+            raise ParseError('Multipart form parse error - %s' % unicode(exc))
+
+
+class XMLParser(BaseParser):
+    """
+    XML parser.
+    """
+
+    media_type = 'application/xml'
+
+    def parse(self, stream, media_type=None, parser_context=None):
+        try:
+            tree = ET.parse(stream)
+        except (ExpatError, ETParseError, ValueError), exc:
+            raise ParseError('XML parse error - %s' % unicode(exc))
+        data = self._xml_convert(tree.getroot())
+
+        return data
+
+    def _xml_convert(self, element):
+        """
+        convert the xml `element` into the corresponding python object
+        """
+
+        children = element.getchildren()
+
+        if len(children) == 0:
+            return self._type_convert(element.text)
+        else:
+            # if the fist child tag is list-item means all children are list-item
+            if children[0].tag == "list-item":
+                data = []
+                for child in children:
+                    data.append(self._xml_convert(child))
+            else:
+                data = {}
+                for child in children:
+                    data[child.tag] = self._xml_convert(child)
+
+            return data
+
+    def _type_convert(self, value):
+        """
+        Converts the value returned by the XMl parse into the equivalent
+        Python type
+        """
+        if value is None:
+            return value
+
+        try:
+            return datetime.datetime.strptime(value, '%Y-%m-%d %H:%M:%S')
+        except ValueError:
+            pass
+
+        try:
+            return int(value)
+        except ValueError:
+            pass
+
+        try:
+            return decimal.Decimal(value)
+        except decimal.InvalidOperation:
+            pass
+
+        return value

thirdpart/rest_framework/permissions.py

@@ -0,0 +1,114 @@
+"""
+Provides a set of pluggable permission policies.
+"""
+
+
+SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS']
+
+
+class BasePermission(object):
+    """
+    A base class from which all permission classes should inherit.
+    """
+
+    def has_permission(self, request, view, obj=None):
+        """
+        Return `True` if permission is granted, `False` otherwise.
+        """
+        raise NotImplementedError(".has_permission() must be overridden.")
+
+
+class AllowAny(BasePermission):
+    """
+    Allow any access.
+    This isn't strictly required, since you could use an empty
+    permission_classes list, but it's useful because it makes the intention
+    more explicit.
+    """
+    def has_permission(self, request, view, obj=None):
+        return True
+
+
+class IsAuthenticated(BasePermission):
+    """
+    Allows access only to authenticated users.
+    """
+
+    def has_permission(self, request, view, obj=None):
+        if request.user and request.user.is_authenticated():
+            return True
+        return False
+
+
+class IsAdminUser(BasePermission):
+    """
+    Allows access only to admin users.
+    """
+
+    def has_permission(self, request, view, obj=None):
+        if request.user and request.user.is_staff:
+            return True
+        return False
+
+
+class IsAuthenticatedOrReadOnly(BasePermission):
+    """
+    The request is authenticated as a user, or is a read-only request.
+    """
+
+    def has_permission(self, request, view, obj=None):
+        if (request.method in SAFE_METHODS or
+            request.user and
+            request.user.is_authenticated()):
+            return True
+        return False
+
+
+class DjangoModelPermissions(BasePermission):
+    """
+    The request is authenticated using `django.contrib.auth` permissions.
+    See: https://docs.djangoproject.com/en/dev/topics/auth/#permissions
+
+    It ensures that the user is authenticated, and has the appropriate
+    `add`/`change`/`delete` permissions on the model.
+
+    This permission will only be applied against view classes that
+    provide a `.model` attribute, such as the generic class-based views.
+    """
+
+    # Map methods into required permission codes.
+    # Override this if you need to also provide 'view' permissions,
+    # or if you want to provide custom permission codes.
+    perms_map = {
+        'GET': [],
+        'OPTIONS': [],
+        'HEAD': [],
+        'POST': ['%(app_label)s.add_%(model_name)s'],
+        'PUT': ['%(app_label)s.change_%(model_name)s'],
+        'PATCH': ['%(app_label)s.change_%(model_name)s'],
+        'DELETE': ['%(app_label)s.delete_%(model_name)s'],
+    }
+
+    def get_required_permissions(self, method, model_cls):
+        """
+        Given a model and an HTTP method, return the list of permission
+        codes that the user is required to have.
+        """
+        kwargs = {
+            'app_label': model_cls._meta.app_label,
+            'model_name': model_cls._meta.module_name
+        }
+        return [perm % kwargs for perm in self.perms_map[method]]
+
+    def has_permission(self, request, view, obj=None):
+        model_cls = getattr(view, 'model', None)
+        if not model_cls:
+            return True
+
+        perms = self.get_required_permissions(request.method, model_cls)
+
+        if (request.user and
+            request.user.is_authenticated() and
+            request.user.has_perms(perms, obj)):
+            return True
+        return False

thirdpart/rest_framework/renderers.py

@@ -0,0 +1,488 @@
+"""
+Renderers are used to serialize a response into specific media types.
+
+They give us a generic way of being able to handle various media types
+on the response, such as JSON encoded data or HTML output.
+
+REST framework also provides an HTML renderer the renders the browsable API.
+"""
+import copy
+import string
+from django import forms
+from django.http.multipartparser import parse_header
+from django.template import RequestContext, loader, Template
+from django.utils import simplejson as json
+from rest_framework.compat import yaml
+from rest_framework.exceptions import ConfigurationError
+from rest_framework.settings import api_settings
+from rest_framework.request import clone_request
+from rest_framework.utils import dict2xml
+from rest_framework.utils import encoders
+from rest_framework.utils.breadcrumbs import get_breadcrumbs
+from rest_framework import VERSION, status
+from rest_framework import serializers, parsers
+
+
+class BaseRenderer(object):
+    """
+    All renderers should extend this class, setting the `media_type`
+    and `format` attributes, and override the `.render()` method.
+    """
+
+    media_type = None
+    format = None
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        raise NotImplemented('Renderer class requires .render() to be implemented')
+
+
+class JSONRenderer(BaseRenderer):
+    """
+    Renderer which serializes to json.
+    """
+
+    media_type = 'application/json'
+    format = 'json'
+    encoder_class = encoders.JSONEncoder
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        """
+        Render `obj` into json.
+        """
+        if data is None:
+            return ''
+
+        # If 'indent' is provided in the context, then pretty print the result.
+        # E.g. If we're being called by the BrowseableAPIRenderer.
+        renderer_context = renderer_context or {}
+        indent = renderer_context.get('indent', None)
+
+        if accepted_media_type:
+            # If the media type looks like 'application/json; indent=4',
+            # then pretty print the result.
+            base_media_type, params = parse_header(accepted_media_type)
+            indent = params.get('indent', indent)
+            try:
+                indent = max(min(int(indent), 8), 0)
+            except (ValueError, TypeError):
+                indent = None
+
+        return json.dumps(data, cls=self.encoder_class, indent=indent)
+
+
+class JSONPRenderer(JSONRenderer):
+    """
+    Renderer which serializes to json,
+    wrapping the json output in a callback function.
+    """
+
+    media_type = 'application/javascript'
+    format = 'jsonp'
+    callback_parameter = 'callback'
+    default_callback = 'callback'
+
+    def get_callback(self, renderer_context):
+        """
+        Determine the name of the callback to wrap around the json output.
+        """
+        request = renderer_context.get('request', None)
+        params = request and request.GET or {}
+        return params.get(self.callback_parameter, self.default_callback)
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        """
+        Renders into jsonp, wrapping the json output in a callback function.
+
+        Clients may set the callback function name using a query parameter
+        on the URL, for example: ?callback=exampleCallbackName
+        """
+        renderer_context = renderer_context or {}
+        callback = self.get_callback(renderer_context)
+        json = super(JSONPRenderer, self).render(data, accepted_media_type,
+                                                 renderer_context)
+        return u"%s(%s);" % (callback, json)
+
+
+class XMLRenderer(BaseRenderer):
+    """
+    Renderer which serializes to XML.
+    """
+
+    media_type = 'application/xml'
+    format = 'xml'
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        """
+        Renders *obj* into serialized XML.
+        """
+        if data is None:
+            return ''
+        return dict2xml(data)
+
+
+class YAMLRenderer(BaseRenderer):
+    """
+    Renderer which serializes to YAML.
+    """
+
+    media_type = 'application/yaml'
+    format = 'yaml'
+    encoder = encoders.SafeDumper
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        """
+        Renders *obj* into serialized YAML.
+        """
+        if data is None:
+            return ''
+
+        return yaml.dump(data, stream=None, Dumper=self.encoder)
+
+
+class TemplateHTMLRenderer(BaseRenderer):
+    """
+    An HTML renderer for use with templates.
+
+    The data supplied to the Response object should be a dictionary that will
+    be used as context for the template.
+
+    The template name is determined by (in order of preference):
+
+    1. An explicit `.template_name` attribute set on the response.
+    2. An explicit `.template_name` attribute set on this class.
+    3. The return result of calling `view.get_template_names()`.
+
+    For example:
+        data = {'users': User.objects.all()}
+        return Response(data, template_name='users.html')
+
+    For pre-rendered HTML, see StaticHTMLRenderer.
+    """
+
+    media_type = 'text/html'
+    format = 'html'
+    template_name = None
+    exception_template_names = [
+        '%(status_code)s.html',
+        'api_exception.html'
+    ]
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        """
+        Renders data to HTML, using Django's standard template rendering.
+
+        The template name is determined by (in order of preference):
+
+        1. An explicit .template_name set on the response.
+        2. An explicit .template_name set on this class.
+        3. The return result of calling view.get_template_names().
+        """
+        renderer_context = renderer_context or {}
+        view = renderer_context['view']
+        request = renderer_context['request']
+        response = renderer_context['response']
+
+        if response.exception:
+            template = self.get_exception_template(response)
+        else:
+            template_names = self.get_template_names(response, view)
+            template = self.resolve_template(template_names)
+
+        context = self.resolve_context(data, request, response)
+        return template.render(context)
+
+    def resolve_template(self, template_names):
+        return loader.select_template(template_names)
+
+    def resolve_context(self, data, request, response):
+        if response.exception:
+            data['status_code'] = response.status_code
+        return RequestContext(request, data)
+
+    def get_template_names(self, response, view):
+        if response.template_name:
+            return [response.template_name]
+        elif self.template_name:
+            return [self.template_name]
+        elif hasattr(view, 'get_template_names'):
+            return view.get_template_names()
+        raise ConfigurationError('Returned a template response with no template_name')
+
+    def get_exception_template(self, response):
+        template_names = [name % {'status_code': response.status_code}
+                          for name in self.exception_template_names]
+
+        try:
+            # Try to find an appropriate error template
+            return self.resolve_template(template_names)
+        except:
+            # Fall back to using eg '404 Not Found'
+            return Template('%d %s' % (response.status_code,
+                                       response.status_text.title()))
+
+
+# Note, subclass TemplateHTMLRenderer simply for the exception behavior
+class StaticHTMLRenderer(TemplateHTMLRenderer):
+    """
+    An HTML renderer class that simply returns pre-rendered HTML.
+
+    The data supplied to the Response object should be a string representing
+    the pre-rendered HTML content.
+
+    For example:
+        data = '<html><body>example</body></html>'
+        return Response(data)
+
+    For template rendered HTML, see TemplateHTMLRenderer.
+    """
+    media_type = 'text/html'
+    format = 'html'
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        renderer_context = renderer_context or {}
+        response = renderer_context['response']
+
+        if response and response.exception:
+            request = renderer_context['request']
+            template = self.get_exception_template(response)
+            context = self.resolve_context(data, request, response)
+            return template.render(context)
+
+        return data
+
+
+class BrowsableAPIRenderer(BaseRenderer):
+    """
+    HTML renderer used to self-document the API.
+    """
+    media_type = 'text/html'
+    format = 'api'
+    template = 'rest_framework/api.html'
+
+    def get_default_renderer(self, view):
+        """
+        Return an instance of the first valid renderer.
+        (Don't use another documenting renderer.)
+        """
+        renderers = [renderer for renderer in view.renderer_classes
+                     if not issubclass(renderer, BrowsableAPIRenderer)]
+        if not renderers:
+            return None
+        return renderers[0]()
+
+    def get_content(self, renderer, data,
+                    accepted_media_type, renderer_context):
+        """
+        Get the content as if it had been rendered by the default
+        non-documenting renderer.
+        """
+        if not renderer:
+            return '[No renderers were found]'
+
+        renderer_context['indent'] = 4
+        content = renderer.render(data, accepted_media_type, renderer_context)
+
+        if not all(char in string.printable for char in content):
+            return '[%d bytes of binary content]'
+
+        return content
+
+    def show_form_for_method(self, view, method, request, obj):
+        """
+        Returns True if a form should be shown for this method.
+        """
+        if not method in view.allowed_methods:
+            return  # Not a valid method
+
+        if not api_settings.FORM_METHOD_OVERRIDE:
+            return  # Cannot use form overloading
+
+        request = clone_request(request, method)
+        try:
+            if not view.has_permission(request, obj):
+                return  # Don't have permission
+        except:
+            return  # Don't have permission and exception explicitly raise
+        return True
+
+    def serializer_to_form_fields(self, serializer):
+        field_mapping = {
+            serializers.FloatField: forms.FloatField,
+            serializers.IntegerField: forms.IntegerField,
+            serializers.DateTimeField: forms.DateTimeField,
+            serializers.DateField: forms.DateField,
+            serializers.EmailField: forms.EmailField,
+            serializers.RegexField: forms.RegexField,
+            serializers.CharField: forms.CharField,
+            serializers.ChoiceField: forms.ChoiceField,
+            serializers.BooleanField: forms.BooleanField,
+            serializers.PrimaryKeyRelatedField: forms.ChoiceField,
+            serializers.ManyPrimaryKeyRelatedField: forms.MultipleChoiceField,
+            serializers.SlugRelatedField: forms.ChoiceField,
+            serializers.ManySlugRelatedField: forms.MultipleChoiceField,
+            serializers.HyperlinkedRelatedField: forms.ChoiceField,
+            serializers.ManyHyperlinkedRelatedField: forms.MultipleChoiceField,
+            serializers.FileField: forms.FileField,
+            serializers.ImageField: forms.ImageField,
+        }
+
+        fields = {}
+        for k, v in serializer.get_fields().items():
+            if getattr(v, 'read_only', True):
+                continue
+
+            kwargs = {}
+            kwargs['required'] = v.required
+
+            #if getattr(v, 'queryset', None):
+            #    kwargs['queryset'] = v.queryset
+
+            if getattr(v, 'choices', None) is not None:
+                kwargs['choices'] = v.choices
+
+            if getattr(v, 'widget', None):
+                widget = copy.deepcopy(v.widget)
+                kwargs['widget'] = widget
+
+            if getattr(v, 'default', None) is not None:
+                kwargs['initial'] = v.default
+
+            kwargs['label'] = k
+
+            try:
+                fields[k] = field_mapping[v.__class__](**kwargs)
+            except KeyError:
+                if getattr(v, 'choices', None) is not None:
+                    fields[k] = forms.ChoiceField(**kwargs)
+                else:
+                    fields[k] = forms.CharField(**kwargs)
+        return fields
+
+    def get_form(self, view, method, request):
+        """
+        Get a form, possibly bound to either the input or output data.
+        In the absence on of the Resource having an associated form then
+        provide a form that can be used to submit arbitrary content.
+        """
+        obj = getattr(view, 'object', None)
+        if not self.show_form_for_method(view, method, request, obj):
+            return
+
+        if method == 'DELETE' or method == 'OPTIONS':
+            return True  # Don't actually need to return a form
+
+        if not getattr(view, 'get_serializer', None) or not parsers.FormParser in view.parser_classes:
+            media_types = [parser.media_type for parser in view.parser_classes]
+            return self.get_generic_content_form(media_types)
+
+        serializer = view.get_serializer(instance=obj)
+        fields = self.serializer_to_form_fields(serializer)
+
+        # Creating an on the fly form see:
+        # http://stackoverflow.com/questions/3915024/dynamically-creating-classes-python
+        OnTheFlyForm = type("OnTheFlyForm", (forms.Form,), fields)
+        data = (obj is not None) and serializer.data or None
+        form_instance = OnTheFlyForm(data)
+        return form_instance
+
+    def get_generic_content_form(self, media_types):
+        """
+        Returns a form that allows for arbitrary content types to be tunneled
+        via standard HTML forms.
+        (Which are typically application/x-www-form-urlencoded)
+        """
+
+        # If we're not using content overloading there's no point in supplying a generic form,
+        # as the view won't treat the form's value as the content of the request.
+        if not (api_settings.FORM_CONTENT_OVERRIDE
+                and api_settings.FORM_CONTENTTYPE_OVERRIDE):
+            return None
+
+        content_type_field = api_settings.FORM_CONTENTTYPE_OVERRIDE
+        content_field = api_settings.FORM_CONTENT_OVERRIDE
+        choices = [(media_type, media_type) for media_type in media_types]
+        initial = media_types[0]
+
+        # NB. http://jacobian.org/writing/dynamic-form-generation/
+        class GenericContentForm(forms.Form):
+            def __init__(self):
+                super(GenericContentForm, self).__init__()
+
+                self.fields[content_type_field] = forms.ChoiceField(
+                    label='Content Type',
+                    choices=choices,
+                    initial=initial
+                )
+                self.fields[content_field] = forms.CharField(
+                    label='Content',
+                    widget=forms.Textarea
+                )
+
+        return GenericContentForm()
+
+    def get_name(self, view):
+        try:
+            return view.get_name()
+        except AttributeError:
+            return view.__doc__
+
+    def get_description(self, view):
+        try:
+            return view.get_description(html=True)
+        except AttributeError:
+            return view.__doc__
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        """
+        Renders *obj* using the :attr:`template` set on the class.
+
+        The context used in the template contains all the information
+        needed to self-document the response to this request.
+        """
+        accepted_media_type = accepted_media_type or ''
+        renderer_context = renderer_context or {}
+
+        view = renderer_context['view']
+        request = renderer_context['request']
+        response = renderer_context['response']
+
+        renderer = self.get_default_renderer(view)
+        content = self.get_content(renderer, data, accepted_media_type, renderer_context)
+
+        put_form = self.get_form(view, 'PUT', request)
+        post_form = self.get_form(view, 'POST', request)
+        delete_form = self.get_form(view, 'DELETE', request)
+        options_form = self.get_form(view, 'OPTIONS', request)
+
+        name = self.get_name(view)
+        description = self.get_description(view)
+        breadcrumb_list = get_breadcrumbs(request.path)
+
+        template = loader.get_template(self.template)
+        context = RequestContext(request, {
+            'content': content,
+            'view': view,
+            'request': request,
+            'response': response,
+            'description': description,
+            'name': name,
+            'version': VERSION,
+            'breadcrumblist': breadcrumb_list,
+            'allowed_methods': view.allowed_methods,
+            'available_formats': [renderer.format for renderer in view.renderer_classes],
+            'put_form': put_form,
+            'post_form': post_form,
+            'delete_form': delete_form,
+            'options_form': options_form,
+            'api_settings': api_settings
+        })
+
+        ret = template.render(context)
+
+        # Munge DELETE Response code to allow us to return content
+        # (Do this *after* we've rendered the template so that we include
+        # the normal deletion response code in the output)
+        if response.status_code == status.HTTP_204_NO_CONTENT:
+            response.status_code = status.HTTP_200_OK
+
+        return ret

thirdpart/rest_framework/request.py

@@ -0,0 +1,317 @@
+"""
+The :mod:`request` module provides a :class:`Request` class used to wrap the standard `request`
+object received in all the views.
+
+The wrapped request then offers a richer API, in particular :
+
+    - content automatically parsed according to `Content-Type` header,
+      and available as :meth:`.DATA<Request.DATA>`
+    - full support of PUT method, including support for file uploads
+    - form overloading of HTTP method, content type and content
+"""
+from StringIO import StringIO
+
+from django.http.multipartparser import parse_header
+from rest_framework import exceptions
+from rest_framework.settings import api_settings
+
+
+def is_form_media_type(media_type):
+    """
+    Return True if the media type is a valid form media type.
+    """
+    base_media_type, params = parse_header(media_type)
+    return (base_media_type == 'application/x-www-form-urlencoded' or
+            base_media_type == 'multipart/form-data')
+
+
+class Empty(object):
+    """
+    Placeholder for unset attributes.
+    Cannot use `None`, as that may be a valid value.
+    """
+    pass
+
+
+def _hasattr(obj, name):
+    return not getattr(obj, name) is Empty
+
+
+def clone_request(request, method):
+    """
+    Internal helper method to clone a request, replacing with a different
+    HTTP method.  Used for checking permissions against other methods.
+    """
+    ret = Request(request._request,
+                  request.parsers,
+                  request.authenticators,
+                  request.parser_context)
+    ret._data = request._data
+    ret._files = request._files
+    ret._content_type = request._content_type
+    ret._stream = request._stream
+    ret._method = method
+    if hasattr(request, '_user'):
+        ret._user = request._user
+    if hasattr(request, '_auth'):
+        ret._auth = request._auth
+    return ret
+
+
+class Request(object):
+    """
+    Wrapper allowing to enhance a standard `HttpRequest` instance.
+
+    Kwargs:
+        - request(HttpRequest). The original request instance.
+        - parsers_classes(list/tuple). The parsers to use for parsing the
+          request content.
+        - authentication_classes(list/tuple). The authentications used to try
+          authenticating the request's user.
+    """
+
+    _METHOD_PARAM = api_settings.FORM_METHOD_OVERRIDE
+    _CONTENT_PARAM = api_settings.FORM_CONTENT_OVERRIDE
+    _CONTENTTYPE_PARAM = api_settings.FORM_CONTENTTYPE_OVERRIDE
+
+    def __init__(self, request, parsers=None, authenticators=None,
+                 negotiator=None, parser_context=None):
+        self._request = request
+        self.parsers = parsers or ()
+        self.authenticators = authenticators or ()
+        self.negotiator = negotiator or self._default_negotiator()
+        self.parser_context = parser_context
+        self._data = Empty
+        self._files = Empty
+        self._method = Empty
+        self._content_type = Empty
+        self._stream = Empty
+
+        if self.parser_context is None:
+            self.parser_context = {}
+        self.parser_context['request'] = self
+
+    def _default_negotiator(self):
+        return api_settings.DEFAULT_CONTENT_NEGOTIATION_CLASS()
+
+    @property
+    def method(self):
+        """
+        Returns the HTTP method.
+
+        This allows the `method` to be overridden by using a hidden `form`
+        field on a form POST request.
+        """
+        if not _hasattr(self, '_method'):
+            self._load_method_and_content_type()
+        return self._method
+
+    @property
+    def content_type(self):
+        """
+        Returns the content type header.
+
+        This should be used instead of `request.META.get('HTTP_CONTENT_TYPE')`,
+        as it allows the content type to be overridden by using a hidden form
+        field on a form POST request.
+        """
+        if not _hasattr(self, '_content_type'):
+            self._load_method_and_content_type()
+        return self._content_type
+
+    @property
+    def stream(self):
+        """
+        Returns an object that may be used to stream the request content.
+        """
+        if not _hasattr(self, '_stream'):
+            self._load_stream()
+        return self._stream
+
+    @property
+    def QUERY_PARAMS(self):
+        """
+        More semantically correct name for request.GET.
+        """
+        return self._request.GET
+
+    @property
+    def DATA(self):
+        """
+        Parses the request body and returns the data.
+
+        Similar to usual behaviour of `request.POST`, except that it handles
+        arbitrary parsers, and also works on methods other than POST (eg PUT).
+        """
+        if not _hasattr(self, '_data'):
+            self._load_data_and_files()
+        return self._data
+
+    @property
+    def FILES(self):
+        """
+        Parses the request body and returns any files uploaded in the request.
+
+        Similar to usual behaviour of `request.FILES`, except that it handles
+        arbitrary parsers, and also works on methods other than POST (eg PUT).
+        """
+        if not _hasattr(self, '_files'):
+            self._load_data_and_files()
+        return self._files
+
+    @property
+    def user(self):
+        """
+        Returns the user associated with the current request, as authenticated
+        by the authentication classes provided to the request.
+        """
+        if not hasattr(self, '_user'):
+            self._user, self._auth = self._authenticate()
+        return self._user
+
+    @property
+    def auth(self):
+        """
+        Returns any non-user authentication information associated with the
+        request, such as an authentication token.
+        """
+        if not hasattr(self, '_auth'):
+            self._user, self._auth = self._authenticate()
+        return self._auth
+
+    def _load_data_and_files(self):
+        """
+        Parses the request content into self.DATA and self.FILES.
+        """
+        if not _hasattr(self, '_content_type'):
+            self._load_method_and_content_type()
+
+        if not _hasattr(self, '_data'):
+            self._data, self._files = self._parse()
+
+    def _load_method_and_content_type(self):
+        """
+        Sets the method and content_type, and then check if they've
+        been overridden.
+        """
+        self._content_type = self.META.get('HTTP_CONTENT_TYPE',
+                                           self.META.get('CONTENT_TYPE', ''))
+        self._perform_form_overloading()
+        # if the HTTP method was not overloaded, we take the raw HTTP method
+        if not _hasattr(self, '_method'):
+            self._method = self._request.method
+
+    def _load_stream(self):
+        """
+        Return the content body of the request, as a stream.
+        """
+        try:
+            content_length = int(self.META.get('CONTENT_LENGTH',
+                                    self.META.get('HTTP_CONTENT_LENGTH')))
+        except (ValueError, TypeError):
+            content_length = 0
+
+        if content_length == 0:
+            self._stream = None
+        elif hasattr(self._request, 'read'):
+            self._stream = self._request
+        else:
+            self._stream = StringIO(self.raw_post_data)
+
+    def _perform_form_overloading(self):
+        """
+        If this is a form POST request, then we need to check if the method and
+        content/content_type have been overridden by setting them in hidden
+        form fields or not.
+        """
+
+        USE_FORM_OVERLOADING = (
+            self._METHOD_PARAM or
+            (self._CONTENT_PARAM and self._CONTENTTYPE_PARAM)
+        )
+
+        # We only need to use form overloading on form POST requests.
+        if (not USE_FORM_OVERLOADING
+            or self._request.method != 'POST'
+            or not is_form_media_type(self._content_type)):
+            return
+
+        # At this point we're committed to parsing the request as form data.
+        self._data = self._request.POST
+        self._files = self._request.FILES
+
+        # Method overloading - change the method and remove the param from the content.
+        if (self._METHOD_PARAM and
+            self._METHOD_PARAM in self._data):
+            self._method = self._data[self._METHOD_PARAM].upper()
+
+        # Content overloading - modify the content type, and force re-parse.
+        if (self._CONTENT_PARAM and
+            self._CONTENTTYPE_PARAM and
+            self._CONTENT_PARAM in self._data and
+            self._CONTENTTYPE_PARAM in self._data):
+            self._content_type = self._data[self._CONTENTTYPE_PARAM]
+            self._stream = StringIO(self._data[self._CONTENT_PARAM])
+            self._data, self._files = (Empty, Empty)
+
+    def _parse(self):
+        """
+        Parse the request content, returning a two-tuple of (data, files)
+
+        May raise an `UnsupportedMediaType`, or `ParseError` exception.
+        """
+        stream = self.stream
+        media_type = self.content_type
+
+        if stream is None or media_type is None:
+            return (None, None)
+
+        parser = self.negotiator.select_parser(self, self.parsers)
+
+        if not parser:
+            raise exceptions.UnsupportedMediaType(media_type)
+
+        parsed = parser.parse(stream, media_type, self.parser_context)
+
+        # Parser classes may return the raw data, or a
+        # DataAndFiles object.  Unpack the result as required.
+        try:
+            return (parsed.data, parsed.files)
+        except AttributeError:
+            return (parsed, None)
+
+    def _authenticate(self):
+        """
+        Attempt to authenticate the request using each authentication instance in turn.
+        Returns a two-tuple of (user, authtoken).
+        """
+        for authenticator in self.authenticators:
+            user_auth_tuple = authenticator.authenticate(self)
+            if not user_auth_tuple is None:
+                return user_auth_tuple
+        return self._not_authenticated()
+
+    def _not_authenticated(self):
+        """
+        Return a two-tuple of (user, authtoken), representing an
+        unauthenticated request.
+
+        By default this will be (AnonymousUser, None).
+        """
+        if api_settings.UNAUTHENTICATED_USER:
+            user = api_settings.UNAUTHENTICATED_USER()
+        else:
+            user = None
+
+        if api_settings.UNAUTHENTICATED_TOKEN:
+            auth = api_settings.UNAUTHENTICATED_TOKEN()
+        else:
+            auth = None
+
+        return (user, auth)
+
+    def __getattr__(self, attr):
+        """
+        Proxy other attributes to the underlying HttpRequest object.
+        """
+        return getattr(self._request, attr)

thirdpart/rest_framework/response.py

@@ -0,0 +1,62 @@
+from django.core.handlers.wsgi import STATUS_CODE_TEXT
+from django.template.response import SimpleTemplateResponse
+
+
+class Response(SimpleTemplateResponse):
+    """
+    An HttpResponse that allows it's data to be rendered into
+    arbitrary media types.
+    """
+
+    def __init__(self, data=None, status=200,
+                 template_name=None, headers=None,
+                 exception=False):
+        """
+        Alters the init arguments slightly.
+        For example, drop 'template_name', and instead use 'data'.
+
+        Setting 'renderer' and 'media_type' will typically be deferred,
+        For example being set automatically by the `APIView`.
+        """
+        super(Response, self).__init__(None, status=status)
+        self.data = data
+        self.template_name = template_name
+        self.exception = exception
+        
+        if headers:
+            for name,value in headers.iteritems():
+                self[name] = value
+
+    @property
+    def rendered_content(self):
+        renderer = getattr(self, 'accepted_renderer', None)
+        media_type = getattr(self, 'accepted_media_type', None)
+        context = getattr(self, 'renderer_context', None)
+
+        assert renderer, ".accepted_renderer not set on Response"
+        assert media_type, ".accepted_media_type not set on Response"
+        assert context, ".renderer_context not set on Response"
+        context['response'] = self
+
+        self['Content-Type'] = media_type
+        return renderer.render(self.data, media_type, context)
+
+    @property
+    def status_text(self):
+        """
+        Returns reason text corresponding to our HTTP response status code.
+        Provided for convenience.
+        """
+        # TODO: Deprecate and use a template tag instead
+        # TODO: Status code text for RFC 6585 status codes
+        return STATUS_CODE_TEXT.get(self.status_code, '')
+
+    def __getstate__(self):
+        """
+        Remove attributes from the response that shouldn't be cached
+        """
+        state = super(Response, self).__getstate__()
+        for key in ('accepted_renderer', 'renderer_context', 'data'):
+            if key in state:
+                del state[key]
+        return state

thirdpart/rest_framework/reverse.py

@@ -0,0 +1,22 @@
+"""
+Provide reverse functions that return fully qualified URLs
+"""
+from django.core.urlresolvers import reverse as django_reverse
+from django.utils.functional import lazy
+
+
+def reverse(viewname, args=None, kwargs=None, request=None, format=None, **extra):
+    """
+    Same as `django.core.urlresolvers.reverse`, but optionally takes a request
+    and returns a fully qualified URL, using the request to get the base URL.
+    """
+    if format is not None:
+        kwargs = kwargs or {}
+        kwargs['format'] = format
+    url = django_reverse(viewname, args=args, kwargs=kwargs, **extra)
+    if request:
+        return request.build_absolute_uri(url)
+    return url
+
+
+reverse_lazy = lazy(reverse, str)

thirdpart/rest_framework/runtests/runcoverage.py

@@ -0,0 +1,66 @@
+#!/usr/bin/env python
+"""
+Useful tool to run the test suite for rest_framework and generate a coverage report.
+"""
+
+# http://ericholscher.com/blog/2009/jun/29/enable-setuppy-test-your-django-apps/
+# http://www.travisswicegood.com/2010/01/17/django-virtualenv-pip-and-fabric/
+# http://code.djangoproject.com/svn/django/trunk/tests/runtests.py
+import os
+import sys
+os.environ['DJANGO_SETTINGS_MODULE'] = 'rest_framework.runtests.settings'
+
+from coverage import coverage
+
+
+def main():
+    """Run the tests for rest_framework and generate a coverage report."""
+
+    cov = coverage()
+    cov.erase()
+    cov.start()
+
+    from django.conf import settings
+    from django.test.utils import get_runner
+    TestRunner = get_runner(settings)
+
+    if hasattr(TestRunner, 'func_name'):
+        # Pre 1.2 test runners were just functions,
+        # and did not support the 'failfast' option.
+        import warnings
+        warnings.warn(
+            'Function-based test runners are deprecated. Test runners should be classes with a run_tests() method.',
+            DeprecationWarning
+        )
+        failures = TestRunner(['tests'])
+    else:
+        test_runner = TestRunner()
+        failures = test_runner.run_tests(['tests'])
+    cov.stop()
+
+    # Discover the list of all modules that we should test coverage for
+    import rest_framework
+
+    project_dir = os.path.dirname(rest_framework.__file__)
+    cov_files = []
+
+    for (path, dirs, files) in os.walk(project_dir):
+        # Drop tests and runtests directories from the test coverage report
+        if os.path.basename(path) in ['tests', 'runtests', 'migrations']:
+            continue
+
+        # Drop the compat module from coverage, since we're not interested in the coverage
+        # of a module which is specifically for resolving environment dependant imports.
+        # (Because we'll end up getting different coverage reports for it for each environment)
+        if 'compat.py' in files:
+            files.remove('compat.py')
+
+        cov_files.extend([os.path.join(path, file) for file in files if file.endswith('.py')])
+
+    cov.report(cov_files)
+    if '--html' in sys.argv:
+        cov.html_report(cov_files, directory='coverage')
+    sys.exit(failures)
+
+if __name__ == '__main__':
+    main()

thirdpart/rest_framework/runtests/runtests.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+
+# http://ericholscher.com/blog/2009/jun/29/enable-setuppy-test-your-django-apps/
+# http://www.travisswicegood.com/2010/01/17/django-virtualenv-pip-and-fabric/
+# http://code.djangoproject.com/svn/django/trunk/tests/runtests.py
+import os
+import sys
+os.environ['DJANGO_SETTINGS_MODULE'] = 'rest_framework.runtests.settings'
+
+from django.conf import settings
+from django.test.utils import get_runner
+
+
+def usage():
+    return """
+    Usage: python runtests.py [UnitTestClass].[method]
+
+    You can pass the Class name of the `UnitTestClass` you want to test.
+
+    Append a method name if you only want to test a specific method of that class.
+    """
+
+
+def main():
+    TestRunner = get_runner(settings)
+
+    test_runner = TestRunner()
+    if len(sys.argv) == 2:
+        test_case = '.' + sys.argv[1]
+    elif len(sys.argv) == 1:
+        test_case = ''
+    else:
+        print usage()
+        sys.exit(1)
+    failures = test_runner.run_tests(['tests' + test_case])
+
+    sys.exit(failures)
+
+if __name__ == '__main__':
+    main()

thirdpart/rest_framework/runtests/settings.py

@@ -0,0 +1,117 @@
+# Django settings for testproject project.
+
+DEBUG = True
+TEMPLATE_DEBUG = DEBUG
+DEBUG_PROPAGATE_EXCEPTIONS = True
+
+ADMINS = (
+    # ('Your Name', 'your_email@domain.com'),
+)
+
+MANAGERS = ADMINS
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',  # Add 'postgresql_psycopg2', 'postgresql', 'mysql', 'sqlite3' or 'oracle'.
+        'NAME': 'sqlite.db',                     # Or path to database file if using sqlite3.
+        'USER': '',                      # Not used with sqlite3.
+        'PASSWORD': '',                  # Not used with sqlite3.
+        'HOST': '',                      # Set to empty string for localhost. Not used with sqlite3.
+        'PORT': '',                      # Set to empty string for default. Not used with sqlite3.
+    }
+}
+
+CACHES = {
+    'default': {
+        'BACKEND': 'django.core.cache.backends.locmem.LocMemCache',
+    }
+}
+
+# Local time zone for this installation. Choices can be found here:
+# http://en.wikipedia.org/wiki/List_of_tz_zones_by_name
+# although not all choices may be available on all operating systems.
+# On Unix systems, a value of None will cause Django to use the same
+# timezone as the operating system.
+# If running in a Windows environment this must be set to the same as your
+# system time zone.
+TIME_ZONE = 'Europe/London'
+
+# Language code for this installation. All choices can be found here:
+# http://www.i18nguy.com/unicode/language-identifiers.html
+LANGUAGE_CODE = 'en-uk'
+
+SITE_ID = 1
+
+# If you set this to False, Django will make some optimizations so as not
+# to load the internationalization machinery.
+USE_I18N = True
+
+# If you set this to False, Django will not format dates, numbers and
+# calendars according to the current locale
+USE_L10N = True
+
+# Absolute filesystem path to the directory that will hold user-uploaded files.
+# Example: "/home/media/media.lawrence.com/"
+MEDIA_ROOT = ''
+
+# URL that handles the media served from MEDIA_ROOT. Make sure to use a
+# trailing slash if there is a path component (optional in other cases).
+# Examples: "http://media.lawrence.com", "http://example.com/media/"
+MEDIA_URL = ''
+
+# Make this unique, and don't share it with anybody.
+SECRET_KEY = 'u@x-aj9(hoh#rb-^ymf#g2jx_hp0vj7u5#b@ag1n^seu9e!%cy'
+
+# List of callables that know how to import templates from various sources.
+TEMPLATE_LOADERS = (
+    'django.template.loaders.filesystem.Loader',
+    'django.template.loaders.app_directories.Loader',
+#     'django.template.loaders.eggs.Loader',
+)
+
+MIDDLEWARE_CLASSES = (
+    'django.middleware.common.CommonMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+)
+
+ROOT_URLCONF = 'urls'
+
+TEMPLATE_DIRS = (
+    # Put strings here, like "/home/html/django_templates" or "C:/www/django/templates".
+    # Always use forward slashes, even on Windows.
+    # Don't forget to use absolute paths, not relative paths.
+)
+
+INSTALLED_APPS = (
+    'django.contrib.auth',
+    'django.contrib.contenttypes',
+    'django.contrib.sessions',
+    'django.contrib.sites',
+    'django.contrib.messages',
+    # Uncomment the next line to enable the admin:
+    # 'django.contrib.admin',
+    # Uncomment the next line to enable admin documentation:
+    # 'django.contrib.admindocs',
+    'rest_framework',
+    'rest_framework.authtoken',
+    'rest_framework.tests'
+)
+
+STATIC_URL = '/static/'
+
+import django
+
+if django.VERSION < (1, 3):
+    INSTALLED_APPS += ('staticfiles',)
+
+
+# If we're running on the Jenkins server we want to archive the coverage reports as XML.
+import os
+if os.environ.get('HUDSON_URL', None):
+    TEST_RUNNER = 'xmlrunner.extra.djangotestrunner.XMLTestRunner'
+    TEST_OUTPUT_VERBOSE = True
+    TEST_OUTPUT_DESCRIPTIONS = True
+    TEST_OUTPUT_DIR = 'xmlrunner'

thirdpart/rest_framework/runtests/urls.py

@@ -0,0 +1,7 @@
+"""
+Blank URLConf just to keep runtests.py happy.
+"""
+from django.conf.urls.defaults import *
+
+urlpatterns = patterns('',
+)

thirdpart/rest_framework/serializers.py

@@ -0,0 +1,541 @@
+import copy
+import datetime
+import types
+from decimal import Decimal
+from django.db import models
+from django.forms import widgets
+from django.utils.datastructures import SortedDict
+from rest_framework.compat import get_concrete_model
+
+# Note: We do the following so that users of the framework can use this style:
+#
+#     example_field = serializers.CharField(...)
+#
+# This helps keep the seperation between model fields, form fields, and
+# serializer fields more explicit.
+
+
+from rest_framework.fields import *
+
+
+class DictWithMetadata(dict):
+    """
+    A dict-like object, that can have additional properties attached.
+    """
+    pass
+
+
+class SortedDictWithMetadata(SortedDict, DictWithMetadata):
+    """
+    A sorted dict-like object, that can have additional properties attached.
+    """
+    pass
+
+
+def _is_protected_type(obj):
+    """
+    True if the object is a native datatype that does not need to
+    be serialized further.
+    """
+    return isinstance(obj, (
+        types.NoneType,
+        int, long,
+        datetime.datetime, datetime.date, datetime.time,
+        float, Decimal,
+        basestring)
+    )
+
+
+def _get_declared_fields(bases, attrs):
+    """
+    Create a list of serializer field instances from the passed in 'attrs',
+    plus any fields on the base classes (in 'bases').
+
+    Note that all fields from the base classes are used.
+    """
+    fields = [(field_name, attrs.pop(field_name))
+              for field_name, obj in attrs.items()
+              if isinstance(obj, Field)]
+    fields.sort(key=lambda x: x[1].creation_counter)
+
+    # If this class is subclassing another Serializer, add that Serializer's
+    # fields.  Note that we loop over the bases in *reverse*. This is necessary
+    # in order to maintain the correct order of fields.
+    for base in bases[::-1]:
+        if hasattr(base, 'base_fields'):
+            fields = base.base_fields.items() + fields
+
+    return SortedDict(fields)
+
+
+class SerializerMetaclass(type):
+    def __new__(cls, name, bases, attrs):
+        attrs['base_fields'] = _get_declared_fields(bases, attrs)
+        return super(SerializerMetaclass, cls).__new__(cls, name, bases, attrs)
+
+
+class SerializerOptions(object):
+    """
+    Meta class options for Serializer
+    """
+    def __init__(self, meta):
+        self.depth = getattr(meta, 'depth', 0)
+        self.fields = getattr(meta, 'fields', ())
+        self.exclude = getattr(meta, 'exclude', ())
+
+
+class BaseSerializer(Field):
+    class Meta(object):
+        pass
+
+    _options_class = SerializerOptions
+    _dict_class = SortedDictWithMetadata  # Set to unsorted dict for backwards compatibility with unsorted implementations.
+
+    def __init__(self, instance=None, data=None, files=None, context=None, partial=False, **kwargs):
+        super(BaseSerializer, self).__init__(**kwargs)
+        self.opts = self._options_class(self.Meta)
+        self.parent = None
+        self.root = None
+        self.partial = partial
+
+        self.context = context or {}
+
+        self.init_data = data
+        self.init_files = files
+        self.object = instance
+        self.fields = self.get_fields()
+
+        self._data = None
+        self._files = None
+        self._errors = None
+
+    #####
+    # Methods to determine which fields to use when (de)serializing objects.
+
+    def get_default_fields(self):
+        """
+        Return the complete set of default fields for the object, as a dict.
+        """
+        return {}
+
+    def get_fields(self):
+        """
+        Returns the complete set of fields for the object as a dict.
+
+        This will be the set of any explicitly declared fields,
+        plus the set of fields returned by get_default_fields().
+        """
+        ret = SortedDict()
+
+        # Get the explicitly declared fields
+        base_fields = copy.deepcopy(self.base_fields)
+        for key, field in base_fields.items():
+            ret[key] = field
+            # Set up the field
+            field.initialize(parent=self, field_name=key)
+
+        # Add in the default fields
+        default_fields = self.get_default_fields()
+        for key, val in default_fields.items():
+            if key not in ret:
+                ret[key] = val
+
+        # If 'fields' is specified, use those fields, in that order.
+        if self.opts.fields:
+            new = SortedDict()
+            for key in self.opts.fields:
+                new[key] = ret[key]
+            ret = new
+
+        # Remove anything in 'exclude'
+        if self.opts.exclude:
+            for key in self.opts.exclude:
+                ret.pop(key, None)
+
+        return ret
+
+    #####
+    # Field methods - used when the serializer class is itself used as a field.
+
+    def initialize(self, parent, field_name):
+        """
+        Same behaviour as usual Field, except that we need to keep track
+        of state so that we can deal with handling maximum depth.
+        """
+        super(BaseSerializer, self).initialize(parent, field_name)
+        if parent.opts.depth:
+            self.opts.depth = parent.opts.depth - 1
+
+    #####
+    # Methods to convert or revert from objects <--> primitive representations.
+
+    def get_field_key(self, field_name):
+        """
+        Return the key that should be used for a given field.
+        """
+        return field_name
+
+    def convert_object(self, obj):
+        """
+        Core of serialization.
+        Convert an object into a dictionary of serialized field values.
+        """
+        ret = self._dict_class()
+        ret.fields = {}
+
+        for field_name, field in self.fields.items():
+            key = self.get_field_key(field_name)
+            value = field.field_to_native(obj, field_name)
+            ret[key] = value
+            ret.fields[key] = field
+        return ret
+
+    def restore_fields(self, data, files):
+        """
+        Core of deserialization, together with `restore_object`.
+        Converts a dictionary of data into a dictionary of deserialized fields.
+        """
+        reverted_data = {}
+        for field_name, field in self.fields.items():
+            try:
+                field.field_from_native(data, files, field_name, reverted_data)
+            except ValidationError as err:
+                self._errors[field_name] = list(err.messages)
+
+        return reverted_data
+
+    def perform_validation(self, attrs):
+        """
+        Run `validate_<fieldname>()` and `validate()` methods on the serializer
+        """
+        for field_name, field in self.fields.items():
+            try:
+                validate_method = getattr(self, 'validate_%s' % field_name, None)
+                if validate_method:
+                    source = field.source or field_name
+                    attrs = validate_method(attrs, source)
+            except ValidationError as err:
+                self._errors[field_name] = self._errors.get(field_name, []) + list(err.messages)
+
+        try:
+            attrs = self.validate(attrs)
+        except ValidationError as err:
+            self._errors['non_field_errors'] = err.messages
+
+        return attrs
+
+    def validate(self, attrs):
+        """
+        Stub method, to be overridden in Serializer subclasses
+        """
+        return attrs
+
+    def restore_object(self, attrs, instance=None):
+        """
+        Deserialize a dictionary of attributes into an object instance.
+        You should override this method to control how deserialized objects
+        are instantiated.
+        """
+        if instance is not None:
+            instance.update(attrs)
+            return instance
+        return attrs
+
+    def to_native(self, obj):
+        """
+        Serialize objects -> primitives.
+        """
+        if hasattr(obj, '__iter__'):
+            return [self.convert_object(item) for item in obj]
+        return self.convert_object(obj)
+
+    def from_native(self, data, files):
+        """
+        Deserialize primitives -> objects.
+        """
+        if hasattr(data, '__iter__') and not isinstance(data, dict):
+            # TODO: error data when deserializing lists
+            return (self.from_native(item) for item in data)
+
+        self._errors = {}
+        if data is not None or files is not None:
+            attrs = self.restore_fields(data, files)
+            attrs = self.perform_validation(attrs)
+        else:
+            self._errors['non_field_errors'] = ['No input provided']
+
+        if not self._errors:
+            return self.restore_object(attrs, instance=getattr(self, 'object', None))
+
+    def field_to_native(self, obj, field_name):
+        """
+        Override default so that we can apply ModelSerializer as a nested
+        field to relationships.
+        """
+        obj = getattr(obj, self.source or field_name)
+
+        if is_simple_callable(obj):
+            obj = obj()
+
+        # If the object has an "all" method, assume it's a relationship
+        if is_simple_callable(getattr(obj, 'all', None)):
+            return [self.to_native(item) for item in obj.all()]
+
+        return self.to_native(obj)
+
+    @property
+    def errors(self):
+        """
+        Run deserialization and return error data,
+        setting self.object if no errors occurred.
+        """
+        if self._errors is None:
+            obj = self.from_native(self.init_data, self.init_files)
+            if not self._errors:
+                self.object = obj
+        return self._errors
+
+    def is_valid(self):
+        return not self.errors
+
+    @property
+    def data(self):
+        if self._data is None:
+            self._data = self.to_native(self.object)
+        return self._data
+
+    def save(self):
+        """
+        Save the deserialized object and return it.
+        """
+        self.object.save()
+        return self.object
+
+
+class Serializer(BaseSerializer):
+    __metaclass__ = SerializerMetaclass
+
+
+class ModelSerializerOptions(SerializerOptions):
+    """
+    Meta class options for ModelSerializer
+    """
+    def __init__(self, meta):
+        super(ModelSerializerOptions, self).__init__(meta)
+        self.model = getattr(meta, 'model', None)
+        self.read_only_fields = getattr(meta, 'read_only_fields', ())
+
+
+class ModelSerializer(Serializer):
+    """
+    A serializer that deals with model instances and querysets.
+    """
+    _options_class = ModelSerializerOptions
+
+    def get_default_fields(self):
+        """
+        Return all the fields that should be serialized for the model.
+        """
+
+        cls = self.opts.model
+        opts = get_concrete_model(cls)._meta
+        pk_field = opts.pk
+        while pk_field.rel:
+            pk_field = pk_field.rel.to._meta.pk
+        fields = [pk_field]
+        fields += [field for field in opts.fields if field.serialize]
+        fields += [field for field in opts.many_to_many if field.serialize]
+
+        ret = SortedDict()
+        nested = bool(self.opts.depth)
+        is_pk = True  # First field in the list is the pk
+
+        for model_field in fields:
+            if is_pk:
+                field = self.get_pk_field(model_field)
+                is_pk = False
+            elif model_field.rel and nested:
+                field = self.get_nested_field(model_field)
+            elif model_field.rel:
+                to_many = isinstance(model_field,
+                                     models.fields.related.ManyToManyField)
+                field = self.get_related_field(model_field, to_many=to_many)
+            else:
+                field = self.get_field(model_field)
+
+            if field:
+                field.initialize(parent=self, field_name=model_field.name)
+                ret[model_field.name] = field
+
+        for field_name in self.opts.read_only_fields:
+            assert field_name in ret, \
+                "read_only_fields on '%s' included invalid item '%s'" % \
+                (self.__class__.__name__, field_name)
+            ret[field_name].read_only = True
+
+        return ret
+
+    def get_pk_field(self, model_field):
+        """
+        Returns a default instance of the pk field.
+        """
+        return Field()
+
+    def get_nested_field(self, model_field):
+        """
+        Creates a default instance of a nested relational field.
+        """
+        class NestedModelSerializer(ModelSerializer):
+            class Meta:
+                model = model_field.rel.to
+        return NestedModelSerializer()
+
+    def get_related_field(self, model_field, to_many=False):
+        """
+        Creates a default instance of a flat relational field.
+        """
+        # TODO: filter queryset using:
+        # .using(db).complex_filter(self.rel.limit_choices_to)
+        queryset = model_field.rel.to._default_manager
+        if to_many:
+            return ManyPrimaryKeyRelatedField(queryset=queryset)
+        return PrimaryKeyRelatedField(queryset=queryset)
+
+    def get_field(self, model_field):
+        """
+        Creates a default instance of a basic non-relational field.
+        """
+        kwargs = {}
+
+        kwargs['blank'] = model_field.blank
+
+        if model_field.null:
+            kwargs['required'] = False
+
+        if model_field.has_default():
+            kwargs['required'] = False
+            kwargs['default'] = model_field.get_default()
+
+        if model_field.__class__ == models.TextField:
+            kwargs['widget'] = widgets.Textarea
+
+        # TODO: TypedChoiceField?
+        if model_field.flatchoices:  # This ModelField contains choices
+            kwargs['choices'] = model_field.flatchoices
+            return ChoiceField(**kwargs)
+
+        max_length = getattr(model_field, 'max_length', None)
+        if max_length:
+            kwargs['max_length'] = max_length
+
+        field_mapping = {
+            models.FloatField: FloatField,
+            models.IntegerField: IntegerField,
+            models.PositiveIntegerField: IntegerField,
+            models.SmallIntegerField: IntegerField,
+            models.PositiveSmallIntegerField: IntegerField,
+            models.DateTimeField: DateTimeField,
+            models.DateField: DateField,
+            models.EmailField: EmailField,
+            models.CharField: CharField,
+            models.URLField: URLField,
+            models.SlugField: SlugField,
+            models.TextField: CharField,
+            models.CommaSeparatedIntegerField: CharField,
+            models.BooleanField: BooleanField,
+            models.FileField: FileField,
+            models.ImageField: ImageField,
+        }
+        try:
+            return field_mapping[model_field.__class__](**kwargs)
+        except KeyError:
+            return ModelField(model_field=model_field, **kwargs)
+
+    def restore_object(self, attrs, instance=None):
+        """
+        Restore the model instance.
+        """
+        self.m2m_data = {}
+
+        if instance is not None:
+            for key, val in attrs.items():
+                setattr(instance, key, val)
+            return instance
+
+        # Reverse relations
+        for (obj, model) in self.opts.model._meta.get_all_related_m2m_objects_with_model():
+            field_name = obj.field.related_query_name()
+            if field_name in attrs:
+                self.m2m_data[field_name] = attrs.pop(field_name)
+
+        # Forward relations
+        for field in self.opts.model._meta.many_to_many:
+            if field.name in attrs:
+                self.m2m_data[field.name] = attrs.pop(field.name)
+        return self.opts.model(**attrs)
+
+    def save(self, save_m2m=True):
+        """
+        Save the deserialized object and return it.
+        """
+        self.object.save()
+
+        if getattr(self, 'm2m_data', None) and save_m2m:
+            for accessor_name, object_list in self.m2m_data.items():
+                setattr(self.object, accessor_name, object_list)
+            self.m2m_data = {}
+
+        return self.object
+
+
+class HyperlinkedModelSerializerOptions(ModelSerializerOptions):
+    """
+    Options for HyperlinkedModelSerializer
+    """
+    def __init__(self, meta):
+        super(HyperlinkedModelSerializerOptions, self).__init__(meta)
+        self.view_name = getattr(meta, 'view_name', None)
+
+
+class HyperlinkedModelSerializer(ModelSerializer):
+    """
+    """
+    _options_class = HyperlinkedModelSerializerOptions
+    _default_view_name = '%(model_name)s-detail'
+
+    url = HyperlinkedIdentityField()
+
+    def __init__(self, *args, **kwargs):
+        super(HyperlinkedModelSerializer, self).__init__(*args, **kwargs)
+        if self.opts.view_name is None:
+            self.opts.view_name = self._get_default_view_name(self.opts.model)
+
+    def _get_default_view_name(self, model):
+        """
+        Return the view name to use if 'view_name' is not specified in 'Meta'
+        """
+        model_meta = model._meta
+        format_kwargs = {
+            'app_label': model_meta.app_label,
+            'model_name': model_meta.object_name.lower()
+        }
+        return self._default_view_name % format_kwargs
+
+    def get_pk_field(self, model_field):
+        return None
+
+    def get_related_field(self, model_field, to_many):
+        """
+        Creates a default instance of a flat relational field.
+        """
+        # TODO: filter queryset using:
+        # .using(db).complex_filter(self.rel.limit_choices_to)
+        rel = model_field.rel.to
+        queryset = rel._default_manager
+        kwargs = {
+            'queryset': queryset,
+            'view_name': self._get_default_view_name(rel)
+        }
+        if to_many:
+            return ManyHyperlinkedRelatedField(**kwargs)
+        return HyperlinkedRelatedField(**kwargs)

thirdpart/rest_framework/settings.py

@@ -0,0 +1,165 @@
+"""
+Settings for REST framework are all namespaced in the REST_FRAMEWORK setting.
+For example your project's `settings.py` file might look like this:
+
+REST_FRAMEWORK = {
+    'DEFAULT_RENDERER_CLASSES': (
+        'rest_framework.renderers.JSONRenderer',
+        'rest_framework.renderers.YAMLRenderer',
+    )
+    'DEFAULT_PARSER_CLASSES': (
+        'rest_framework.parsers.JSONParser',
+        'rest_framework.parsers.YAMLParser',
+    )
+}
+
+This module provides the `api_setting` object, that is used to access
+REST framework settings, checking for user settings first, then falling
+back to the defaults.
+"""
+from django.conf import settings
+from django.utils import importlib
+
+
+USER_SETTINGS = getattr(settings, 'REST_FRAMEWORK', None)
+
+DEFAULTS = {
+    'DEFAULT_RENDERER_CLASSES': (
+        'rest_framework.renderers.JSONRenderer',
+        'rest_framework.renderers.BrowsableAPIRenderer',
+    ),
+    'DEFAULT_PARSER_CLASSES': (
+        'rest_framework.parsers.JSONParser',
+        'rest_framework.parsers.FormParser',
+        'rest_framework.parsers.MultiPartParser'
+    ),
+    'DEFAULT_AUTHENTICATION_CLASSES': (
+        'rest_framework.authentication.SessionAuthentication',
+        'rest_framework.authentication.BasicAuthentication'
+    ),
+    'DEFAULT_PERMISSION_CLASSES': (
+        'rest_framework.permissions.AllowAny',
+    ),
+    'DEFAULT_THROTTLE_CLASSES': (
+    ),
+
+    'DEFAULT_CONTENT_NEGOTIATION_CLASS':
+        'rest_framework.negotiation.DefaultContentNegotiation',
+    'DEFAULT_MODEL_SERIALIZER_CLASS':
+        'rest_framework.serializers.ModelSerializer',
+    'DEFAULT_PAGINATION_SERIALIZER_CLASS':
+        'rest_framework.pagination.PaginationSerializer',
+
+    'DEFAULT_THROTTLE_RATES': {
+        'user': None,
+        'anon': None,
+    },
+
+    # Pagination
+    'PAGINATE_BY': None,
+    'PAGINATE_BY_PARAM': None,
+
+    # Filtering
+    'FILTER_BACKEND': None,
+
+    # Authentication
+    'UNAUTHENTICATED_USER': 'django.contrib.auth.models.AnonymousUser',
+    'UNAUTHENTICATED_TOKEN': None,
+
+    # Browser enhancements
+    'FORM_METHOD_OVERRIDE': '_method',
+    'FORM_CONTENT_OVERRIDE': '_content',
+    'FORM_CONTENTTYPE_OVERRIDE': '_content_type',
+    'URL_ACCEPT_OVERRIDE': 'accept',
+    'URL_FORMAT_OVERRIDE': 'format',
+
+    'FORMAT_SUFFIX_KWARG': 'format',
+}
+
+
+# List of settings that may be in string import notation.
+IMPORT_STRINGS = (
+    'DEFAULT_RENDERER_CLASSES',
+    'DEFAULT_PARSER_CLASSES',
+    'DEFAULT_AUTHENTICATION_CLASSES',
+    'DEFAULT_PERMISSION_CLASSES',
+    'DEFAULT_THROTTLE_CLASSES',
+    'DEFAULT_CONTENT_NEGOTIATION_CLASS',
+    'DEFAULT_MODEL_SERIALIZER_CLASS',
+    'DEFAULT_PAGINATION_SERIALIZER_CLASS',
+    'FILTER_BACKEND',
+    'UNAUTHENTICATED_USER',
+    'UNAUTHENTICATED_TOKEN',
+)
+
+
+def perform_import(val, setting_name):
+    """
+    If the given setting is a string import notation,
+    then perform the necessary import or imports.
+    """
+    if isinstance(val, basestring):
+        return import_from_string(val, setting_name)
+    elif isinstance(val, (list, tuple)):
+        return [import_from_string(item, setting_name) for item in val]
+    return val
+
+
+def import_from_string(val, setting_name):
+    """
+    Attempt to import a class from a string representation.
+    """
+    try:
+        # Nod to tastypie's use of importlib.
+        parts = val.split('.')
+        module_path, class_name = '.'.join(parts[:-1]), parts[-1]
+        module = importlib.import_module(module_path)
+        return getattr(module, class_name)
+    except:
+        msg = "Could not import '%s' for API setting '%s'" % (val, setting_name)
+        raise ImportError(msg)
+
+
+class APISettings(object):
+    """
+    A settings object, that allows API settings to be accessed as properties.
+    For example:
+
+        from rest_framework.settings import api_settings
+        print api_settings.DEFAULT_RENDERER_CLASSES
+
+    Any setting with string import paths will be automatically resolved
+    and return the class, rather than the string literal.
+    """
+    def __init__(self, user_settings=None, defaults=None, import_strings=None):
+        self.user_settings = user_settings or {}
+        self.defaults = defaults or {}
+        self.import_strings = import_strings or ()
+
+    def __getattr__(self, attr):
+        if attr not in self.defaults.keys():
+            raise AttributeError("Invalid API setting: '%s'" % attr)
+
+        try:
+            # Check if present in user settings
+            val = self.user_settings[attr]
+        except KeyError:
+            # Fall back to defaults
+            val = self.defaults[attr]
+
+        # Coerce import strings into classes
+        if val and attr in self.import_strings:
+            val = perform_import(val, attr)
+
+        self.validate_setting(attr, val)
+
+        # Cache the result
+        setattr(self, attr, val)
+        return val
+
+    def validate_setting(self, attr, val):
+        if attr == 'FILTER_BACKEND' and val is not None:
+            # Make sure we can initialize the class
+            val()
+
+api_settings = APISettings(USER_SETTINGS, DEFAULTS, IMPORT_STRINGS)

thirdpart/rest_framework/status.py

@@ -0,0 +1,52 @@
+"""
+Descriptive HTTP status codes, for code readability.
+
+See RFC 2616 - http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
+And RFC 6585 - http://tools.ietf.org/html/rfc6585
+"""
+
+HTTP_100_CONTINUE = 100
+HTTP_101_SWITCHING_PROTOCOLS = 101
+HTTP_200_OK = 200
+HTTP_201_CREATED = 201
+HTTP_202_ACCEPTED = 202
+HTTP_203_NON_AUTHORITATIVE_INFORMATION = 203
+HTTP_204_NO_CONTENT = 204
+HTTP_205_RESET_CONTENT = 205
+HTTP_206_PARTIAL_CONTENT = 206
+HTTP_300_MULTIPLE_CHOICES = 300
+HTTP_301_MOVED_PERMANENTLY = 301
+HTTP_302_FOUND = 302
+HTTP_303_SEE_OTHER = 303
+HTTP_304_NOT_MODIFIED = 304
+HTTP_305_USE_PROXY = 305
+HTTP_306_RESERVED = 306
+HTTP_307_TEMPORARY_REDIRECT = 307
+HTTP_400_BAD_REQUEST = 400
+HTTP_401_UNAUTHORIZED = 401
+HTTP_402_PAYMENT_REQUIRED = 402
+HTTP_403_FORBIDDEN = 403
+HTTP_404_NOT_FOUND = 404
+HTTP_405_METHOD_NOT_ALLOWED = 405
+HTTP_406_NOT_ACCEPTABLE = 406
+HTTP_407_PROXY_AUTHENTICATION_REQUIRED = 407
+HTTP_408_REQUEST_TIMEOUT = 408
+HTTP_409_CONFLICT = 409
+HTTP_410_GONE = 410
+HTTP_411_LENGTH_REQUIRED = 411
+HTTP_412_PRECONDITION_FAILED = 412
+HTTP_413_REQUEST_ENTITY_TOO_LARGE = 413
+HTTP_414_REQUEST_URI_TOO_LONG = 414
+HTTP_415_UNSUPPORTED_MEDIA_TYPE = 415
+HTTP_416_REQUESTED_RANGE_NOT_SATISFIABLE = 416
+HTTP_417_EXPECTATION_FAILED = 417
+HTTP_428_PRECONDITION_REQUIRED = 428
+HTTP_429_TOO_MANY_REQUESTS = 429
+HTTP_431_REQUEST_HEADER_FIELDS_TOO_LARGE = 431
+HTTP_500_INTERNAL_SERVER_ERROR = 500
+HTTP_501_NOT_IMPLEMENTED = 501
+HTTP_502_BAD_GATEWAY = 502
+HTTP_503_SERVICE_UNAVAILABLE = 503
+HTTP_504_GATEWAY_TIMEOUT = 504
+HTTP_505_HTTP_VERSION_NOT_SUPPORTED = 505
+HTTP_511_NETWORK_AUTHENTICATION_REQUIRED = 511

thirdpart/rest_framework/throttling.py

@@ -0,0 +1,208 @@
+import time
+from django.core.cache import cache
+from rest_framework import exceptions
+from rest_framework.settings import api_settings
+
+
+class BaseThrottle(object):
+    """
+    Rate throttling of requests.
+    """
+    def allow_request(self, request, view):
+        """
+        Return `True` if the request should be allowed, `False` otherwise.
+        """
+        raise NotImplementedError('.allow_request() must be overridden')
+
+    def wait(self):
+        """
+        Optionally, return a recommended number of seconds to wait before
+        the next request.
+        """
+        return None
+
+
+class SimpleRateThrottle(BaseThrottle):
+    """
+    A simple cache implementation, that only requires `.get_cache_key()`
+    to be overridden.
+
+    The rate (requests / seconds) is set by a :attr:`throttle` attribute
+    on the :class:`.View` class.  The attribute is a string of the form 'number of
+    requests/period'.
+
+    Period should be one of: ('s', 'sec', 'm', 'min', 'h', 'hour', 'd', 'day')
+
+    Previous request information used for throttling is stored in the cache.
+    """
+
+    timer = time.time
+    settings = api_settings
+    cache_format = 'throtte_%(scope)s_%(ident)s'
+    scope = None
+
+    def __init__(self):
+        if not getattr(self, 'rate', None):
+            self.rate = self.get_rate()
+        self.num_requests, self.duration = self.parse_rate(self.rate)
+
+    def get_cache_key(self, request, view):
+        """
+        Should return a unique cache-key which can be used for throttling.
+        Must be overridden.
+
+        May return `None` if the request should not be throttled.
+        """
+        raise NotImplementedError('.get_cache_key() must be overridden')
+
+    def get_rate(self):
+        """
+        Determine the string representation of the allowed request rate.
+        """
+        if not getattr(self, 'scope', None):
+            msg = ("You must set either `.scope` or `.rate` for '%s' throttle" %
+                   self.__class__.__name__)
+            raise exceptions.ConfigurationError(msg)
+
+        try:
+            return self.settings.DEFAULT_THROTTLE_RATES[self.scope]
+        except KeyError:
+            msg = "No default throttle rate set for '%s' scope" % self.scope
+            raise exceptions.ConfigurationError(msg)
+
+    def parse_rate(self, rate):
+        """
+        Given the request rate string, return a two tuple of:
+        <allowed number of requests>, <period of time in seconds>
+        """
+        if rate is None:
+            return (None, None)
+        num, period = rate.split('/')
+        num_requests = int(num)
+        duration = {'s': 1, 'm': 60, 'h': 3600, 'd': 86400}[period[0]]
+        return (num_requests, duration)
+
+    def allow_request(self, request, view):
+        """
+        Implement the check to see if the request should be throttled.
+
+        On success calls `throttle_success`.
+        On failure calls `throttle_failure`.
+        """
+        if self.rate is None:
+            return True
+
+        self.key = self.get_cache_key(request, view)
+        self.history = cache.get(self.key, [])
+        self.now = self.timer()
+
+        # Drop any requests from the history which have now passed the
+        # throttle duration
+        while self.history and self.history[-1] <= self.now - self.duration:
+            self.history.pop()
+        if len(self.history) >= self.num_requests:
+            return self.throttle_failure()
+        return self.throttle_success()
+
+    def throttle_success(self):
+        """
+        Inserts the current request's timestamp along with the key
+        into the cache.
+        """
+        self.history.insert(0, self.now)
+        cache.set(self.key, self.history, self.duration)
+        return True
+
+    def throttle_failure(self):
+        """
+        Called when a request to the API has failed due to throttling.
+        """
+        return False
+
+    def wait(self):
+        """
+        Returns the recommended next request time in seconds.
+        """
+        if self.history:
+            remaining_duration = self.duration - (self.now - self.history[-1])
+        else:
+            remaining_duration = self.duration
+
+        available_requests = self.num_requests - len(self.history) + 1
+
+        return remaining_duration / float(available_requests)
+
+
+class AnonRateThrottle(SimpleRateThrottle):
+    """
+    Limits the rate of API calls that may be made by a anonymous users.
+
+    The IP address of the request will be used as the unique cache key.
+    """
+    scope = 'anon'
+
+    def get_cache_key(self, request, view):
+        if request.user.is_authenticated():
+            return None  # Only throttle unauthenticated requests.
+
+        ident = request.META.get('REMOTE_ADDR', None)
+
+        return self.cache_format % {
+            'scope': self.scope,
+            'ident': ident
+        }
+
+
+class UserRateThrottle(SimpleRateThrottle):
+    """
+    Limits the rate of API calls that may be made by a given user.
+
+    The user id will be used as a unique cache key if the user is
+    authenticated.  For anonymous requests, the IP address of the request will
+    be used.
+    """
+    scope = 'user'
+
+    def get_cache_key(self, request, view):
+        if request.user.is_authenticated():
+            ident = request.user.id
+        else:
+            ident = request.META.get('REMOTE_ADDR', None)
+
+        return self.cache_format % {
+            'scope': self.scope,
+            'ident': ident
+        }
+
+
+class ScopedRateThrottle(SimpleRateThrottle):
+    """
+    Limits the rate of API calls by different amounts for various parts of
+    the API.  Any view that has the `throttle_scope` property set will be
+    throttled.  The unique cache key will be generated by concatenating the
+    user id of the request, and the scope of the view being accessed.
+    """
+    scope_attr = 'throttle_scope'
+
+    def get_cache_key(self, request, view):
+        """
+        If `view.throttle_scope` is not set, don't apply this throttle.
+
+        Otherwise generate the unique cache key by concatenating the user id
+        with the '.throttle_scope` property of the view.
+        """
+        scope = getattr(view, self.scope_attr, None)
+
+        if not scope:
+            # Only throttle views if `.throttle_scope` is set on the view.
+            return None
+
+        if request.user.is_authenticated():
+            ident = request.user.id
+        else:
+            ident = request.META.get('REMOTE_ADDR', None)
+
+        return self.cache_format % {
+            'scope': scope,
+            'ident': ident
+        }

thirdpart/rest_framework/urlpatterns.py

@@ -0,0 +1,42 @@
+from django.conf.urls.defaults import url
+from rest_framework.settings import api_settings
+
+
+def format_suffix_patterns(urlpatterns, suffix_required=False, allowed=None):
+    """
+    Supplement existing urlpatterns with corresponding patterns that also
+    include a '.format' suffix.  Retains urlpattern ordering.
+
+    urlpatterns:
+        A list of URL patterns.
+
+    suffix_required:
+        If `True`, only suffixed URLs will be generated, and non-suffixed
+        URLs will not be used.  Defaults to `False`.
+
+    allowed:
+        An optional tuple/list of allowed suffixes.  eg ['json', 'api']
+        Defaults to `None`, which allows any suffix.
+    """
+    suffix_kwarg = api_settings.FORMAT_SUFFIX_KWARG
+    if allowed:
+        if len(allowed) == 1:
+            allowed_pattern = allowed[0]
+        else:
+            allowed_pattern = '(%s)' % '|'.join(allowed)
+        suffix_pattern = r'\.(?P<%s>%s)$' % (suffix_kwarg, allowed_pattern)
+    else:
+        suffix_pattern = r'\.(?P<%s>[a-z]+)$' % suffix_kwarg
+
+    ret = []
+    for urlpattern in urlpatterns:
+        # Form our complementing '.format' urlpattern
+        regex = urlpattern.regex.pattern.rstrip('$') + suffix_pattern
+        view = urlpattern._callback or urlpattern._callback_str
+        kwargs = urlpattern.default_args
+        name = urlpattern.name
+        # Add in both the existing and the new urlpattern
+        if not suffix_required:
+            ret.append(urlpattern)
+        ret.append(url(regex, view, kwargs, name))
+    return ret

thirdpart/rest_framework/urls.py

@@ -0,0 +1,23 @@
+"""
+Login and logout views for the browsable API.
+
+Add these to your root URLconf if you're using the browsable API and
+your API requires authentication.
+
+The urls must be namespaced as 'rest_framework', and you should make sure
+your authentication settings include `SessionAuthentication`.
+
+    urlpatterns = patterns('',
+        ...
+        url(r'^auth', include('rest_framework.urls', namespace='rest_framework'))
+    )
+"""
+from django.conf.urls.defaults import patterns, url
+
+
+template_name = {'template_name': 'rest_framework/login.html'}
+
+urlpatterns = patterns('django.contrib.auth.views',
+    url(r'^login/$', 'login', template_name, name='login'),
+    url(r'^logout/$', 'logout', template_name, name='logout'),
+)

thirdpart/rest_framework/utils/__init__.py

@@ -0,0 +1,100 @@
+from django.utils.encoding import smart_unicode
+from django.utils.xmlutils import SimplerXMLGenerator
+from rest_framework.compat import StringIO
+import re
+import xml.etree.ElementTree as ET
+
+
+# From xml2dict
+class XML2Dict(object):
+
+    def __init__(self):
+        pass
+
+    def _parse_node(self, node):
+        node_tree = {}
+        # Save attrs and text, hope there will not be a child with same name
+        if node.text:
+            node_tree = node.text
+        for (k, v) in node.attrib.items():
+            k, v = self._namespace_split(k, v)
+            node_tree[k] = v
+        #Save childrens
+        for child in node.getchildren():
+            tag, tree = self._namespace_split(child.tag, self._parse_node(child))
+            if  tag not in node_tree:  # the first time, so store it in dict
+                node_tree[tag] = tree
+                continue
+            old = node_tree[tag]
+            if not isinstance(old, list):
+                node_tree.pop(tag)
+                node_tree[tag] = [old]  # multi times, so change old dict to a list
+            node_tree[tag].append(tree)  # add the new one
+
+        return  node_tree
+
+    def _namespace_split(self, tag, value):
+        """
+           Split the tag  '{http://cs.sfsu.edu/csc867/myscheduler}patients'
+             ns = http://cs.sfsu.edu/csc867/myscheduler
+             name = patients
+        """
+        result = re.compile("\{(.*)\}(.*)").search(tag)
+        if result:
+            value.namespace, tag = result.groups()
+        return (tag, value)
+
+    def parse(self, file):
+        """parse a xml file to a dict"""
+        f = open(file, 'r')
+        return self.fromstring(f.read())
+
+    def fromstring(self, s):
+        """parse a string"""
+        t = ET.fromstring(s)
+        unused_root_tag, root_tree = self._namespace_split(t.tag, self._parse_node(t))
+        return root_tree
+
+
+def xml2dict(input):
+    return XML2Dict().fromstring(input)
+
+
+# Piston:
+class XMLRenderer():
+    def _to_xml(self, xml, data):
+        if isinstance(data, (list, tuple)):
+            for item in data:
+                xml.startElement("list-item", {})
+                self._to_xml(xml, item)
+                xml.endElement("list-item")
+
+        elif isinstance(data, dict):
+            for key, value in data.iteritems():
+                xml.startElement(key, {})
+                self._to_xml(xml, value)
+                xml.endElement(key)
+
+        elif data is None:
+            # Don't output any value
+            pass
+
+        else:
+            xml.characters(smart_unicode(data))
+
+    def dict2xml(self, data):
+        stream = StringIO.StringIO()
+
+        xml = SimplerXMLGenerator(stream, "utf-8")
+        xml.startDocument()
+        xml.startElement("root", {})
+
+        self._to_xml(xml, data)
+
+        xml.endElement("root")
+        xml.endDocument()
+        return stream.getvalue()
+
+
+def dict2xml(input):
+    return XMLRenderer().dict2xml(input)

thirdpart/rest_framework/utils/breadcrumbs.py

@@ -0,0 +1,38 @@
+from django.core.urlresolvers import resolve, get_script_prefix
+
+
+def get_breadcrumbs(url):
+    """Given a url returns a list of breadcrumbs, which are each a tuple of (name, url)."""
+
+    from rest_framework.views import APIView
+
+    def breadcrumbs_recursive(url, breadcrumbs_list, prefix, seen):
+        """Add tuples of (name, url) to the breadcrumbs list, progressively chomping off parts of the url."""
+
+        try:
+            (view, unused_args, unused_kwargs) = resolve(url)
+        except Exception:
+            pass
+        else:
+            # Check if this is a REST framework view, and if so add it to the breadcrumbs
+            if isinstance(getattr(view, 'cls_instance', None), APIView):
+                # Don't list the same view twice in a row.
+                # Probably an optional trailing slash.
+                if not seen or seen[-1] != view:
+                    breadcrumbs_list.insert(0, (view.cls_instance.get_name(), prefix + url))
+                    seen.append(view)
+
+        if url == '':
+            # All done
+            return breadcrumbs_list
+
+        elif url.endswith('/'):
+            # Drop trailing slash off the end and continue to try to resolve more breadcrumbs
+            return breadcrumbs_recursive(url.rstrip('/'), breadcrumbs_list, prefix, seen)
+
+        # Drop trailing non-slash off the end and continue to try to resolve more breadcrumbs
+        return breadcrumbs_recursive(url[:url.rfind('/') + 1], breadcrumbs_list, prefix, seen)
+
+    prefix = get_script_prefix().rstrip('/')
+    url = url[len(prefix):]
+    return breadcrumbs_recursive(url, [], prefix, [])

thirdpart/rest_framework/utils/encoders.py

@@ -0,0 +1,91 @@
+"""
+Helper classes for parsers.
+"""
+import datetime
+import decimal
+import types
+from django.utils import simplejson as json
+from django.utils.datastructures import SortedDict
+from rest_framework.compat import timezone
+from rest_framework.serializers import DictWithMetadata, SortedDictWithMetadata
+
+
+class JSONEncoder(json.JSONEncoder):
+    """
+    JSONEncoder subclass that knows how to encode date/time,
+    decimal types, and generators.
+    """
+    def default(self, o):
+        # For Date Time string spec, see ECMA 262
+        # http://ecma-international.org/ecma-262/5.1/#sec-15.9.1.15
+        if isinstance(o, datetime.datetime):
+            r = o.isoformat()
+            if o.microsecond:
+                r = r[:23] + r[26:]
+            if r.endswith('+00:00'):
+                r = r[:-6] + 'Z'
+            return r
+        elif isinstance(o, datetime.date):
+            return o.isoformat()
+        elif isinstance(o, datetime.time):
+            if timezone and timezone.is_aware(o):
+                raise ValueError("JSON can't represent timezone-aware times.")
+            r = o.isoformat()
+            if o.microsecond:
+                r = r[:12]
+            return r
+        elif isinstance(o, decimal.Decimal):
+            return str(o)
+        elif hasattr(o, '__iter__'):
+            return [i for i in o]
+        return super(JSONEncoder, self).default(o)
+
+
+try:
+    import yaml
+except ImportError:
+    SafeDumper = None
+else:
+    # Adapted from http://pyyaml.org/attachment/ticket/161/use_ordered_dict.py
+    class SafeDumper(yaml.SafeDumper):
+        """
+        Handles decimals as strings.
+        Handles SortedDicts as usual dicts, but preserves field order, rather
+        than the usual behaviour of sorting the keys.
+        """
+        def represent_decimal(self, data):
+            return self.represent_scalar('tag:yaml.org,2002:str', str(data))
+
+        def represent_mapping(self, tag, mapping, flow_style=None):
+            value = []
+            node = yaml.MappingNode(tag, value, flow_style=flow_style)
+            if self.alias_key is not None:
+                self.represented_objects[self.alias_key] = node
+            best_style = True
+            if hasattr(mapping, 'items'):
+                mapping = list(mapping.items())
+                if not isinstance(mapping, SortedDict):
+                    mapping.sort()
+            for item_key, item_value in mapping:
+                node_key = self.represent_data(item_key)
+                node_value = self.represent_data(item_value)
+                if not (isinstance(node_key, yaml.ScalarNode) and not node_key.style):
+                    best_style = False
+                if not (isinstance(node_value, yaml.ScalarNode) and not node_value.style):
+                    best_style = False
+                value.append((node_key, node_value))
+            if flow_style is None:
+                if self.default_flow_style is not None:
+                    node.flow_style = self.default_flow_style
+                else:
+                    node.flow_style = best_style
+            return node
+
+    SafeDumper.add_representer(SortedDict,
+            yaml.representer.SafeRepresenter.represent_dict)
+    SafeDumper.add_representer(DictWithMetadata,
+            yaml.representer.SafeRepresenter.represent_dict)
+    SafeDumper.add_representer(SortedDictWithMetadata,
+            yaml.representer.SafeRepresenter.represent_dict)
+    SafeDumper.add_representer(types.GeneratorType,
+            yaml.representer.SafeRepresenter.represent_list)

thirdpart/rest_framework/utils/mediatypes.py

@@ -0,0 +1,87 @@
+"""
+Handling of media types, as found in HTTP Content-Type and Accept headers.
+
+See http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.7
+"""
+
+from django.http.multipartparser import parse_header
+
+
+def media_type_matches(lhs, rhs):
+    """
+    Returns ``True`` if the media type in the first argument <= the
+    media type in the second argument.  The media types are strings
+    as described by the HTTP spec.
+
+    Valid media type strings include:
+
+    'application/json; indent=4'
+    'application/json'
+    'text/*'
+    '*/*'
+    """
+    lhs = _MediaType(lhs)
+    rhs = _MediaType(rhs)
+    return lhs.match(rhs)
+
+
+def order_by_precedence(media_type_lst):
+    """
+    Returns a list of sets of media type strings, ordered by precedence.
+    Precedence is determined by how specific a media type is:
+
+    3. 'type/subtype; param=val'
+    2. 'type/subtype'
+    1. 'type/*'
+    0. '*/*'
+    """
+    ret = [set(), set(), set(), set()]
+    for media_type in media_type_lst:
+        precedence = _MediaType(media_type).precedence
+        ret[3 - precedence].add(media_type)
+    return [media_types for media_types in ret if media_types]
+
+
+class _MediaType(object):
+    def __init__(self, media_type_str):
+        if media_type_str is None:
+            media_type_str = ''
+        self.orig = media_type_str
+        self.full_type, self.params = parse_header(media_type_str)
+        self.main_type, sep, self.sub_type = self.full_type.partition('/')
+
+    def match(self, other):
+        """Return true if this MediaType satisfies the given MediaType."""
+        for key in self.params.keys():
+            if key != 'q' and other.params.get(key, None) != self.params.get(key, None):
+                return False
+
+        if self.sub_type != '*' and other.sub_type != '*'  and other.sub_type != self.sub_type:
+            return False
+
+        if self.main_type != '*' and other.main_type != '*' and other.main_type != self.main_type:
+            return False
+
+        return True
+
+    @property
+    def precedence(self):
+        """
+        Return a precedence level from 0-3 for the media type given how specific it is.
+        """
+        if self.main_type == '*':
+            return 0
+        elif self.sub_type == '*':
+            return 1
+        elif not self.params or self.params.keys() == ['q']:
+            return 2
+        return 3
+
+    def __str__(self):
+        return unicode(self).encode('utf-8')
+
+    def __unicode__(self):
+        ret = "%s/%s" % (self.main_type, self.sub_type)
+        for key, val in self.params.items():
+            ret += "; %s=%s" % (key, val)
+        return ret

thirdpart/rest_framework/views.py

@@ -0,0 +1,374 @@
+"""
+Provides an APIView class that is used as the base of all class-based views.
+"""
+
+import re
+from django.core.exceptions import PermissionDenied
+from django.http import Http404
+from django.utils.html import escape
+from django.utils.safestring import mark_safe
+from django.views.decorators.csrf import csrf_exempt
+from rest_framework import status, exceptions
+from rest_framework.compat import View, apply_markdown
+from rest_framework.response import Response
+from rest_framework.request import Request
+from rest_framework.settings import api_settings
+
+
+def _remove_trailing_string(content, trailing):
+    """
+    Strip trailing component `trailing` from `content` if it exists.
+    Used when generating names from view classes.
+    """
+    if content.endswith(trailing) and content != trailing:
+        return content[:-len(trailing)]
+    return content
+
+
+def _remove_leading_indent(content):
+    """
+    Remove leading indent from a block of text.
+    Used when generating descriptions from docstrings.
+    """
+    whitespace_counts = [len(line) - len(line.lstrip(' '))
+                         for line in content.splitlines()[1:] if line.lstrip()]
+
+    # unindent the content if needed
+    if whitespace_counts:
+        whitespace_pattern = '^' + (' ' * min(whitespace_counts))
+        content = re.sub(re.compile(whitespace_pattern, re.MULTILINE), '', content)
+    content = content.strip('\n')
+    return content
+
+
+def _camelcase_to_spaces(content):
+    """
+    Translate 'CamelCaseNames' to 'Camel Case Names'.
+    Used when generating names from view classes.
+    """
+    camelcase_boundry = '(((?<=[a-z])[A-Z])|([A-Z](?![A-Z]|$)))'
+    content = re.sub(camelcase_boundry, ' \\1', content).strip()
+    return ' '.join(content.split('_')).title()
+
+
+class APIView(View):
+    settings = api_settings
+
+    renderer_classes = api_settings.DEFAULT_RENDERER_CLASSES
+    parser_classes = api_settings.DEFAULT_PARSER_CLASSES
+    authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES
+    throttle_classes = api_settings.DEFAULT_THROTTLE_CLASSES
+    permission_classes = api_settings.DEFAULT_PERMISSION_CLASSES
+    content_negotiation_class = api_settings.DEFAULT_CONTENT_NEGOTIATION_CLASS
+
+    @classmethod
+    def as_view(cls, **initkwargs):
+        """
+        Override the default :meth:`as_view` to store an instance of the view
+        as an attribute on the callable function.  This allows us to discover
+        information about the view when we do URL reverse lookups.
+        """
+        # TODO: deprecate?
+        view = super(APIView, cls).as_view(**initkwargs)
+        view.cls_instance = cls(**initkwargs)
+        return view
+
+    @property
+    def allowed_methods(self):
+        """
+        Return the list of allowed HTTP methods, uppercased.
+        """
+        return [method.upper() for method in self.http_method_names
+                if hasattr(self, method)]
+
+    @property
+    def default_response_headers(self):
+        # TODO: deprecate?
+        # TODO: Only vary by accept if multiple renderers
+        return {
+            'Allow': ', '.join(self.allowed_methods),
+            'Vary': 'Accept'
+        }
+
+    def get_name(self):
+        """
+        Return the resource or view class name for use as this view's name.
+        Override to customize.
+        """
+        # TODO: deprecate?
+        name = self.__class__.__name__
+        name = _remove_trailing_string(name, 'View')
+        return _camelcase_to_spaces(name)
+
+    def get_description(self, html=False):
+        """
+        Return the resource or view docstring for use as this view's description.
+        Override to customize.
+        """
+        # TODO: deprecate?
+        description = self.__doc__ or ''
+        description = _remove_leading_indent(description)
+        if html:
+            return self.markup_description(description)
+        return description
+
+    def markup_description(self, description):
+        """
+        Apply HTML markup to the description of this view.
+        """
+        # TODO: deprecate?
+        if apply_markdown:
+            description = apply_markdown(description)
+        else:
+            description = escape(description).replace('\n', '<br />')
+        return mark_safe(description)
+
+    def metadata(self, request):
+        return {
+            'name': self.get_name(),
+            'description': self.get_description(),
+            'renders': [renderer.media_type for renderer in self.renderer_classes],
+            'parses': [parser.media_type for parser in self.parser_classes],
+        }
+        #  TODO: Add 'fields', from serializer info, if it exists.
+        # serializer = self.get_serializer()
+        # if serializer is not None:
+        #     field_name_types = {}
+        #     for name, field in form.fields.iteritems():
+        #         field_name_types[name] = field.__class__.__name__
+        #     content['fields'] = field_name_types
+
+    def http_method_not_allowed(self, request, *args, **kwargs):
+        """
+        Called if `request.method` does not correspond to a handler method.
+        """
+        raise exceptions.MethodNotAllowed(request.method)
+
+    def permission_denied(self, request):
+        """
+        If request is not permitted, determine what kind of exception to raise.
+        """
+        raise exceptions.PermissionDenied()
+
+    def throttled(self, request, wait):
+        """
+        If request is throttled, determine what kind of exception to raise.
+        """
+        raise exceptions.Throttled(wait)
+
+    def get_parser_context(self, http_request):
+        """
+        Returns a dict that is passed through to Parser.parse(),
+        as the `parser_context` keyword argument.
+        """
+        # Note: Additionally `request` will also be added to the context
+        #       by the Request object.
+        return {
+            'view': self,
+            'args': getattr(self, 'args', ()),
+            'kwargs': getattr(self, 'kwargs', {})
+        }
+
+    def get_renderer_context(self):
+        """
+        Returns a dict that is passed through to Renderer.render(),
+        as the `renderer_context` keyword argument.
+        """
+        # Note: Additionally 'response' will also be added to the context,
+        #       by the Response object.
+        return {
+            'view': self,
+            'args': getattr(self, 'args', ()),
+            'kwargs': getattr(self, 'kwargs', {}),
+            'request': getattr(self, 'request', None)
+        }
+
+    # API policy instantiation methods
+
+    def get_format_suffix(self, **kwargs):
+        """
+        Determine if the request includes a '.json' style format suffix
+        """
+        if self.settings.FORMAT_SUFFIX_KWARG:
+            return kwargs.get(self.settings.FORMAT_SUFFIX_KWARG)
+
+    def get_renderers(self):
+        """
+        Instantiates and returns the list of renderers that this view can use.
+        """
+        return [renderer() for renderer in self.renderer_classes]
+
+    def get_parsers(self):
+        """
+        Instantiates and returns the list of renderers that this view can use.
+        """
+        return [parser() for parser in self.parser_classes]
+
+    def get_authenticators(self):
+        """
+        Instantiates and returns the list of renderers that this view can use.
+        """
+        return [auth() for auth in self.authentication_classes]
+
+    def get_permissions(self):
+        """
+        Instantiates and returns the list of permissions that this view requires.
+        """
+        return [permission() for permission in self.permission_classes]
+
+    def get_throttles(self):
+        """
+        Instantiates and returns the list of throttles that this view uses.
+        """
+        return [throttle() for throttle in self.throttle_classes]
+
+    def get_content_negotiator(self):
+        """
+        Instantiate and return the content negotiation class to use.
+        """
+        if not getattr(self, '_negotiator', None):
+            self._negotiator = self.content_negotiation_class()
+        return self._negotiator
+
+    # API policy implementation methods
+
+    def perform_content_negotiation(self, request, force=False):
+        """
+        Determine which renderer and media type to use render the response.
+        """
+        renderers = self.get_renderers()
+        conneg = self.get_content_negotiator()
+
+        try:
+            return conneg.select_renderer(request, renderers, self.format_kwarg)
+        except:
+            if force:
+                return (renderers[0], renderers[0].media_type)
+            raise
+
+    def has_permission(self, request, obj=None):
+        """
+        Return `True` if the request should be permitted.
+        """
+        for permission in self.get_permissions():
+            if not permission.has_permission(request, self, obj):
+                return False
+        return True
+
+    def check_throttles(self, request):
+        """
+        Check if request should be throttled.
+        """
+        for throttle in self.get_throttles():
+            if not throttle.allow_request(request, self):
+                self.throttled(request, throttle.wait())
+
+    # Dispatch methods
+
+    def initialize_request(self, request, *args, **kargs):
+        """
+        Returns the initial request object.
+        """
+        parser_context = self.get_parser_context(request)
+
+        return Request(request,
+                       parsers=self.get_parsers(),
+                       authenticators=self.get_authenticators(),
+                       negotiator=self.get_content_negotiator(),
+                       parser_context=parser_context)
+
+    def initial(self, request, *args, **kwargs):
+        """
+        Runs anything that needs to occur prior to calling the method handler.
+        """
+        self.format_kwarg = self.get_format_suffix(**kwargs)
+
+        # Ensure that the incoming request is permitted
+        if not self.has_permission(request):
+            self.permission_denied(request)
+        self.check_throttles(request)
+
+        # Perform content negotiation and store the accepted info on the request
+        neg = self.perform_content_negotiation(request)
+        request.accepted_renderer, request.accepted_media_type = neg
+
+    def finalize_response(self, request, response, *args, **kwargs):
+        """
+        Returns the final response object.
+        """
+        if isinstance(response, Response):
+            if not getattr(request, 'accepted_renderer', None):
+                neg = self.perform_content_negotiation(request, force=True)
+                request.accepted_renderer, request.accepted_media_type = neg
+
+            response.accepted_renderer = request.accepted_renderer
+            response.accepted_media_type = request.accepted_media_type
+            response.renderer_context = self.get_renderer_context()
+
+        for key, value in self.headers.items():
+            response[key] = value
+
+        return response
+
+    def handle_exception(self, exc):
+        """
+        Handle any exception that occurs, by returning an appropriate response,
+        or re-raising the error.
+        """
+        if isinstance(exc, exceptions.Throttled):
+            # Throttle wait header
+            self.headers['X-Throttle-Wait-Seconds'] = '%d' % exc.wait
+
+        if isinstance(exc, exceptions.APIException):
+            return Response({'detail': exc.detail},
+                            status=exc.status_code,
+                            exception=True)
+        elif isinstance(exc, Http404):
+            return Response({'detail': 'Not found'},
+                            status=status.HTTP_404_NOT_FOUND,
+                            exception=True)
+        elif isinstance(exc, PermissionDenied):
+            return Response({'detail': 'Permission denied'},
+                            status=status.HTTP_403_FORBIDDEN,
+                            exception=True)
+        raise
+
+    # Note: session based authentication is explicitly CSRF validated,
+    # all other authentication is CSRF exempt.
+    @csrf_exempt
+    def dispatch(self, request, *args, **kwargs):
+        """
+        `.dispatch()` is pretty much the same as Django's regular dispatch,
+        but with extra hooks for startup, finalize, and exception handling.
+        """
+        request = self.initialize_request(request, *args, **kwargs)
+        self.request = request
+        self.args = args
+        self.kwargs = kwargs
+        self.headers = self.default_response_headers  # deprecate?
+
+        try:
+            self.initial(request, *args, **kwargs)
+
+            # Get the appropriate handler method
+            if request.method.lower() in self.http_method_names:
+                handler = getattr(self, request.method.lower(),
+                                  self.http_method_not_allowed)
+            else:
+                handler = self.http_method_not_allowed
+
+            response = handler(request, *args, **kwargs)
+
+        except Exception as exc:
+            response = self.handle_exception(exc)
+
+        self.response = self.finalize_response(request, response, *args, **kwargs)
+        return self.response
+
+    def options(self, request, *args, **kwargs):
+        """
+        Handler method for HTTP 'OPTIONS' request.
+        We may as well implement this as Django will otherwise provide
+        a less useful default implementation.
+        """
+        return Response(self.metadata(request), status=status.HTTP_200_OK)