from django.contrib.auth.models import User

from rest_framework import viewsets, mixins, generics, filters, permissions
from rest_framework.decorators import detail_route
from rest_framework.permissions import IsAuthenticated
from rest_framework.response import Response

from .models import UserProfile

from .serializers import UserProfileSerializer

# Django REST Framework Viewsets


class IsUserOrAdminOrSuper(permissions.BasePermission):
    """
    Only user or staff can see or modify
    """

    def has_object_permission(self, request, view, obj):
        return (request.user.is_superuser or
                request.user.is_staff or
                obj == request.user)


class IsCreateByAdminOrSuper(permissions.BasePermission):
    """
    Only user or staff can create
    """

    def has_permission(self, request, view):
        return view.action == 'create' and (request.user.is_staff or request.user.is_superuser)


# Profile viewset

class ProfileViewSet(viewsets.GenericViewSet):
   
    queryset = User.objects.all()
    serializer_class = UserProfileSerializer
    permission_classes = (permissions.IsAuthenticated,
                          IsUserOrAdminOrSuper,)
    lookup_field = 'username'

    @detail_route(methods=['get'])
    def profile(self, request, **kwargs):
        """
        Retrieve user's extended profile.
        """
        return Response(UserProfileSerializer(self.get_object()).data)


@@ -840,22 +840,18 @@
         
-return
+if
  view.ac
@@ -870,14 +870,29 @@
 ate'
- and (
+:%0A            return 
 requ
@@ -937,17 +937,54 @@
 uperuser
-)
+%0A        else:%0A            return True
 %0A%0A%0A# Pro

Call viewset create permission.