Change package name: djangorestframework -> rest_framework

.gitignore

@@ -7,7 +7,7 @@ html/
 coverage/
 build/
 dist/
-djangorestframework.egg-info/
+rest_framework.egg-info/
 MANIFEST
 
 !.gitignore

MANIFEST.in

-recursive-include djangorestframework/static *.ico *.txt *.css
-recursive-include djangorestframework/templates *.txt *.html
+recursive-include rest_framework/static *.ico *.txt *.css
+recursive-include rest_framework/templates *.txt *.html
 recursive-include examples .keep *.py *.txt
 recursive-include docs *.py *.rst *.html *.txt
 include AUTHORS LICENSE CHANGELOG.rst requirements.txt tox.ini

README.md

@@ -28,7 +28,7 @@ For more information, check out [the documentation][docs], in particular, the tu
 
 Install using `pip`...
 
-    pip install djangorestframework
+    pip install rest_framework
 
 ...or clone the project from github.
 
@@ -47,7 +47,7 @@ To build the docs.
 
 To run the tests.
 
-    ./djangorestframework/runtests/runtests.py
+    ./rest_framework/runtests/runtests.py
 
 # Changelog
 

docs/api-guide/authentication.md

@@ -28,10 +28,10 @@ The value of `request.user` and `request.auth` for unauthenticated requests can
 
 The default authentication policy may be set globally, using the `DEFAULT_AUTHENTICATION` setting.  For example.
 
-    API_SETTINGS = {
+    REST_FRAMEWORK = {
         'DEFAULT_AUTHENTICATION': (
-            'djangorestframework.authentication.UserBasicAuthentication',
-            'djangorestframework.authentication.SessionAuthentication',
+            'rest_framework.authentication.UserBasicAuthentication',
+            'rest_framework.authentication.SessionAuthentication',
         )
     }
 
@@ -75,11 +75,11 @@ If successfully authenticated, `BasicAuthentication` provides the following cred
 
 This policy uses a simple token-based HTTP Authentication scheme.  Token authentication is appropriate for client-server setups, such as native desktop and mobile clients.
 
-To use the `TokenAuthentication` policy, include `djangorestframework.authtoken` in your `INSTALLED_APPS` setting.
+To use the `TokenAuthentication` policy, include `rest_framework.authtoken` in your `INSTALLED_APPS` setting.
 
 You'll also need to create tokens for your users.
 
-    from djangorestframework.authtoken.models import Token
+    from rest_framework.authtoken.models import Token
 
     token = Token.objects.create(user=...)
     print token.key
@@ -91,7 +91,7 @@ For clients to authenticate, the token key should be included in the `Authorizat
 If successfully authenticated, `TokenAuthentication` provides the following credentials.
 
 * `request.user` will be a `django.contrib.auth.models.User` instance.
-* `request.auth` will be a `djangorestframework.tokenauth.models.BasicToken` instance.
+* `request.auth` will be a `rest_framework.tokenauth.models.BasicToken` instance.
 
 **Note:** If you use `TokenAuthentication` in production you must ensure that your API is only available over `https` only.
 
@@ -102,7 +102,7 @@ This policy uses the [OAuth 2.0][oauth] protocol to authenticate requests.  OAut
 If successfully authenticated, `OAuthAuthentication` provides the following credentials.
 
 * `request.user` will be a `django.contrib.auth.models.User` instance.
-* `request.auth` will be a `djangorestframework.models.OAuthToken` instance.
+* `request.auth` will be a `rest_framework.models.OAuthToken` instance.
 
 ## SessionAuthentication
 

docs/api-guide/permissions.md

@@ -27,9 +27,9 @@ Object level permissions are run by REST framework's generic views when `.get_ob
 
 The default permission policy may be set globally, using the `DEFAULT_PERMISSIONS` setting.  For example.
 
-    API_SETTINGS = {
+    REST_FRAMEWORK = {
         'DEFAULT_PERMISSIONS': (
-            'djangorestframework.permissions.IsAuthenticated',
+            'rest_framework.permissions.IsAuthenticated',
         )
     }
 
@@ -97,4 +97,4 @@ The method should return `True` if the request should be granted access, and `Fa
 [authentication]: authentication.md
 [throttling]: throttling.md
 [contribauth]: https://docs.djangoproject.com/en/1.0/topics/auth/#permissions
-[guardian]: https://github.com/lukaszb/django-guardian
+[guardian]: https://github.com/lukaszb/django-guardian
\ No newline at end of file

docs/api-guide/requests.md

@@ -49,7 +49,7 @@ This allows you to support file uploads from multiple content-types.  For exampl
 
 `request.parsers` may no longer be altered once `request.DATA`, `request.FILES` or `request.POST` have been accessed.
 
-If you're using the `djangorestframework.views.View` class... **[TODO]**
+If you're using the `rest_framework.views.View` class... **[TODO]**
 
 ## .stream
 
@@ -63,6 +63,6 @@ You will not typically need to access `request.stream`, unless you're writing a
 
 `request.authentication` may no longer be altered once `request.user` or `request.auth` have been accessed.
 
-If you're using the `djangorestframework.views.View` class... **[TODO]**
+If you're using the `rest_framework.views.View` class... **[TODO]**
 
-[cite]: https://groups.google.com/d/topic/django-developers/dxI4qVzrBY4/discussion
+[cite]: https://groups.google.com/d/topic/django-developers/dxI4qVzrBY4/discussion
\ No newline at end of file

docs/api-guide/reverse.md

@@ -23,8 +23,8 @@ There's no requirement for you to use them, but if you do then the self-describi
 
 Has the same behavior as [`django.core.urlresolvers.reverse`][reverse], except that it returns a fully qualified URL, using the request to determine the host and port.
 
-    from djangorestframework.utils import reverse
-    from djangorestframework.views import APIView
+    from rest_framework.utils import reverse
+    from rest_framework.views import APIView
    
 	class MyView(APIView):
 	    def get(self, request):
@@ -40,4 +40,4 @@ Has the same behavior as [`django.core.urlresolvers.reverse_lazy`][reverse-lazy]
 
 [cite]: http://www.ics.uci.edu/~fielding/pubs/dissertation/rest_arch_style.htm#sec_5_1_5
 [reverse]: https://docs.djangoproject.com/en/dev/topics/http/urls/#reverse
-[reverse-lazy]: https://docs.djangoproject.com/en/dev/topics/http/urls/#reverse-lazy
+[reverse-lazy]: https://docs.djangoproject.com/en/dev/topics/http/urls/#reverse-lazy
\ No newline at end of file

docs/api-guide/settings.md

@@ -6,16 +6,16 @@
 >
 > — [The Zen of Python][cite]
 
-Configuration for REST framework is all namespaced inside a single Django setting, named `API_SETTINGS`.
+Configuration for REST framework is all namespaced inside a single Django setting, named `REST_FRAMEWORK`.
 
 For example your project's `settings.py` file might include something like this:
 
-    API_SETTINGS = {
+    REST_FRAMEWORK = {
         'DEFAULT_RENDERERS': (
-            'djangorestframework.renderers.YAMLRenderer',
+            'rest_framework.renderers.YAMLRenderer',
         )
         'DEFAULT_PARSERS': (
-            'djangorestframework.parsers.YAMLParser',
+            'rest_framework.parsers.YAMLParser',
         )
     }
 
@@ -24,7 +24,7 @@ For example your project's `settings.py` file might include something like this:
 If you need to access the values of REST framework's API settings in your project,
 you should use the `api_settings` object.  For example.
 
-    from djangorestframework.settings import api_settings
+    from rest_framework.settings import api_settings
     
     print api_settings.DEFAULT_AUTHENTICATION
 
@@ -37,9 +37,9 @@ A list or tuple of renderer classes, that determines the default set of renderer
 Default:
 
     (
-        'djangorestframework.renderers.JSONRenderer',
-        'djangorestframework.renderers.DocumentingHTMLRenderer'
-        'djangorestframework.renderers.TemplateHTMLRenderer'
+        'rest_framework.renderers.JSONRenderer',
+        'rest_framework.renderers.DocumentingHTMLRenderer'
+        'rest_framework.renderers.TemplateHTMLRenderer'
     )
 
 ## DEFAULT_PARSERS
@@ -49,8 +49,8 @@ A list or tuple of parser classes, that determines the default set of parsers us
 Default:
 
     (
-        'djangorestframework.parsers.JSONParser',
-        'djangorestframework.parsers.FormParser'
+        'rest_framework.parsers.JSONParser',
+        'rest_framework.parsers.FormParser'
     )
 
 ## DEFAULT_AUTHENTICATION
@@ -60,8 +60,8 @@ A list or tuple of authentication classes, that determines the default set of au
 Default:
 
     (
-        'djangorestframework.authentication.SessionAuthentication',
-        'djangorestframework.authentication.UserBasicAuthentication'
+        'rest_framework.authentication.SessionAuthentication',
+        'rest_framework.authentication.UserBasicAuthentication'
     )
 
 ## DEFAULT_PERMISSIONS
@@ -80,13 +80,13 @@ Default: `()`
 
 **TODO**
 
-Default: `djangorestframework.serializers.ModelSerializer`
+Default: `rest_framework.serializers.ModelSerializer`
 
 ## DEFAULT_PAGINATION_SERIALIZER
 
 **TODO**
 
-Default: `djangorestframework.pagination.PaginationSerializer`
+Default: `rest_framework.pagination.PaginationSerializer`
 
 ## FORMAT_SUFFIX_KWARG
 

docs/api-guide/status-codes.md

@@ -8,7 +8,7 @@
 
 Using bare status codes in your responses isn't recommended.  REST framework includes a set of named constants that you can use to make more code more obvious and readable.
 
-    from djangorestframework import status
+    from rest_framework import status
 
     def empty_view(self):
         content = {'please move along': 'nothing to see here'}

docs/api-guide/throttling.md

@@ -29,10 +29,10 @@ If any throttle check fails an `exceptions.Throttled` exception will be raised,
 
 The default throttling policy may be set globally, using the `DEFAULT_THROTTLES` and `DEFAULT_THROTTLE_RATES` settings.  For example.
 
-    API_SETTINGS = {
+    REST_FRAMEWORK = {
         'DEFAULT_THROTTLES': (
-            'djangorestframework.throttles.AnonThrottle',
-            'djangorestframework.throttles.UserThrottle',
+            'rest_framework.throttles.AnonThrottle',
+            'rest_framework.throttles.UserThrottle',
         )
         'DEFAULT_THROTTLE_RATES': {
             'anon': '100/day',
@@ -95,7 +95,7 @@ For example, multiple user throttle rates could be implemented by using the foll
 
 ...and the following settings.
 
-    API_SETTINGS = {
+    REST_FRAMEWORK = {
         'DEFAULT_THROTTLES': (
             'example.throttles.BurstRateThrottle',
             'example.throttles.SustainedRateThrottle',
@@ -130,9 +130,9 @@ For example, given the following views...
     
 ...and the following settings.
 
-    API_SETTINGS = {
+    REST_FRAMEWORK = {
         'DEFAULT_THROTTLES': (
-            'djangorestframework.throttles.ScopedRateThrottle',
+            'rest_framework.throttles.ScopedRateThrottle',
         )
         'DEFAULT_THROTTLE_RATES': {
             'contacts': '1000/day',
@@ -148,4 +148,4 @@ To create a custom throttle, override `BaseThrottle` and implement `.allow_reque
 
 Optionally you may also override the `.wait()` method.  If implemented, `.wait()` should return a recomended number of seconds to wait before attempting the next request, or `None`.  The `.wait()` method will only be called if `.check_throttle()` has previously returned `False`.
 
-[permissions]: permissions.md
+[permissions]: permissions.md
\ No newline at end of file

docs/index.md

@@ -40,20 +40,22 @@ Install using `pip`, including any optional packages you want...
     pip install -r requirements.txt
     pip install -r optionals.txt
 
-Add `djangorestframework` to your `INSTALLED_APPS`.
+Add `rest_framework` to your `INSTALLED_APPS`.
 
     INSTALLED_APPS = (
         ...
-        'djangorestframework',        
+        'rest_framework',        
     )
 
 If you're intending to use the browserable API you'll want to add REST framework's login and logout views.  Add the following to your root `urls.py` file.
 
     urlpatterns = patterns('',
         ...
-        url(r'^api-auth/', include('djangorestframework.urls', namespace='djangorestframework'))
+        url(r'^api-auth/', include('rest_framework.urls', namespace='rest_framework'))
     )
- 
+
+Note that the base URL can be whatever you want, but you must include `rest_framework.urls` with the `rest_framework` namespace.
+
 ## Quickstart
 
 **TODO**
@@ -110,7 +112,7 @@ Build the docs:
 
 Run the tests:
 
-    ./djangorestframework/runtests/runtests.py
+    ./rest_framework/runtests/runtests.py
 
 ## License
 

docs/topics/browsable-api.md

@@ -4,7 +4,7 @@ API may stand for Application *Programming* Interface, but humans have to be abl
 
 ## URLs
 
-If you include fully-qualified URLs in your resource output, they will be 'urlized' and made clickable for easy browsing by humans. The `djangorestframework` package includes a [`reverse`][drfreverse] helper for this purpose.
+If you include fully-qualified URLs in your resource output, they will be 'urlized' and made clickable for easy browsing by humans. The `rest_framework` package includes a [`reverse`][drfreverse] helper for this purpose.
 
 
 ## Formats
@@ -14,7 +14,7 @@ By default, the API will return the format specified by the headers, which in th
 
 ## Customizing
 
-To customize the look-and-feel, create a template called `api.html` and add it to your project, eg: `templates/djangorestframework/api.html`, that extends the `djangorestframework/base.html` template.
+To customize the look-and-feel, create a template called `api.html` and add it to your project, eg: `templates/rest_framework/api.html`, that extends the `rest_framework/base.html` template.
 
 The included browsable API template is built with [Bootstrap (2.1.1)][bootstrap], making it easy to customize the look-and-feel.
 

docs/tutorial/1-serialization.md

@@ -45,11 +45,11 @@ The simplest way to get up and running will probably be to use an `sqlite3` data
         }
     }
 
-We'll also need to add our new `blog` app and the `djangorestframework` app to `INSTALLED_APPS`.
+We'll also need to add our new `blog` app and the `rest_framework` app to `INSTALLED_APPS`.
 
     INSTALLED_APPS = (
         ...
-        'djangorestframework',
+        'rest_framework',
         'blog'
     )
 
@@ -81,7 +81,7 @@ Don't forget to sync the database for the first time.
 We're going to create a simple Web API that we can use to edit these comment objects with.  The first thing we need is a way of serializing and deserializing the objects into representations such as `json`.  We do this by declaring serializers, that work very similarly to Django's forms.  Create a file in the project named `serializers.py` and add the following.
 
     from blog import models
-    from djangorestframework import serializers
+    from rest_framework import serializers
 
 
     class CommentSerializer(serializers.Serializer):
@@ -114,8 +114,8 @@ Okay, once we've got a few imports out of the way, we'd better create a few comm
 
     from blog.models import Comment
     from blog.serializers import CommentSerializer
-    from djangorestframework.renderers import JSONRenderer
-    from djangorestframework.parsers import JSONParser
+    from rest_framework.renderers import JSONRenderer
+    from rest_framework.parsers import JSONParser
 
     c1 = Comment(email='leila@example.com', content='nothing to say')
     c2 = Comment(email='tom@example.com', content='foo bar')
@@ -159,8 +159,8 @@ Edit the `blog/views.py` file, and add the following.
 
     from blog.models import Comment
     from blog.serializers import CommentSerializer
-    from djangorestframework.renderers import JSONRenderer
-    from djangorestframework.parsers import JSONParser
+    from rest_framework.renderers import JSONRenderer
+    from rest_framework.parsers import JSONParser
     from django.http import HttpResponse
 
 
@@ -251,4 +251,4 @@ Our API views don't do anything particularly special at the moment, beyond serve
 We'll see how we can start to improve things in [part 2 of the tutorial][tut-2].
 
 [virtualenv]: http://www.virtualenv.org/en/latest/index.html
-[tut-2]: 2-requests-and-responses.md
+[tut-2]: 2-requests-and-responses.md
\ No newline at end of file

docs/tutorial/2-requests-and-responses.md

@@ -40,9 +40,9 @@ We don't need our `JSONResponse` class anymore, so go ahead and delete that.  On
 
     from blog.models import Comment
     from blog.serializers import CommentSerializer
-    from djangorestframework import status
-    from djangorestframework.decorators import api_view
-    from djangorestframework.response import Response
+    from rest_framework import status
+    from rest_framework.decorators import api_view
+    from rest_framework.response import Response
 
     @api_view(['GET', 'POST'])
     def comment_root(request):
@@ -112,7 +112,7 @@ and
 Now update the `urls.py` file slightly, to append a set of `format_suffix_patterns` in addition to the existing URLs.
 
     from django.conf.urls import patterns, url
-    from djangorestframework.urlpatterns import format_suffix_patterns
+    from rest_framework.urlpatterns import format_suffix_patterns
 
     urlpatterns = patterns('blogpost.views',
         url(r'^$', 'comment_root'),
@@ -148,4 +148,4 @@ In [tutorial part 3][tut-3], we'll start using class based views, and see how ge
 [devserver]: http://127.0.0.1:8000/
 [browseable-api]: ../topics/browsable-api.md
 [tut-1]: 1-serialization.md
-[tut-3]: 3-class-based-views.md
+[tut-3]: 3-class-based-views.md
\ No newline at end of file

docs/tutorial/3-class-based-views.md

@@ -9,9 +9,9 @@ We'll start by rewriting the root view as a class based view.  All this involves
     from blog.models import Comment
     from blog.serializers import CommentSerializer
     from django.http import Http404
-    from djangorestframework.views import APIView
-    from djangorestframework.response import Response
-    from djangorestframework import status
+    from rest_framework.views import APIView
+    from rest_framework.response import Response
+    from rest_framework import status
 
 
     class CommentRoot(APIView):
@@ -68,7 +68,7 @@ That's looking good.  Again, it's still pretty similar to the function based vie
 We'll also need to refactor our URLconf slightly now we're using class based views.
 
     from django.conf.urls import patterns, url
-    from djangorestframework.urlpatterns import format_suffix_patterns
+    from rest_framework.urlpatterns import format_suffix_patterns
     from blogpost import views
 
     urlpatterns = patterns('',
@@ -90,8 +90,8 @@ Let's take a look at how we can compose our views by using the mixin classes.
 
     from blog.models import Comment
     from blog.serializers import CommentSerializer
-    from djangorestframework import mixins
-    from djangorestframework import generics
+    from rest_framework import mixins
+    from rest_framework import generics
 
     class CommentRoot(mixins.ListModelMixin,
                       mixins.CreateModelMixin,
@@ -133,7 +133,7 @@ Using the mixin classes we've rewritten the views to use slightly less code than
 
     from blog.models import Comment
     from blog.serializers import CommentSerializer
-    from djangorestframework import generics
+    from rest_framework import generics
 
 
     class CommentRoot(generics.RootAPIView):

docs/tutorial/6-resource-orientated-projects.md

@@ -50,7 +50,7 @@ The handler methods only get bound to the actions when we define the URLConf. He
 Right now that hasn't really saved us a lot of code.  However, now that we're using Resources rather than Views, we actually don't need to design the urlconf ourselves.  The conventions for wiring up resources into views and urls can be handled automatically, using `Router` classes.  All we need to do is register the appropriate resources with a router, and let it do the rest.  Here's our re-wired `urls.py` file.
 
     from blog import resources
-    from djangorestframework.routers import DefaultRouter
+    from rest_framework.routers import DefaultRouter
 
     router = DefaultRouter()
     router.register(resources.BlogPostResource)
@@ -73,4 +73,4 @@ We've reached the end of our tutorial.  If you want to get more involved in the
 
 **Now go build some awesome things.**
 
-[twitter]: https://twitter.com/_tomchristie
+[twitter]: https://twitter.com/_tomchristie
\ No newline at end of file

mkdocs.py

@@ -24,7 +24,7 @@ else:
 
 main_header = '<li class="main"><a href="#{{ anchor }}">{{ title }}</a></li>'
 sub_header = '<li><a href="#{{ anchor }}">{{ title }}</a></li>'
-code_label = r'<a class="github" href="https://github.com/tomchristie/django-rest-framework/blob/restframework2/djangorestframework/\1"><span class="label label-info">\1</span></a>'
+code_label = r'<a class="github" href="https://github.com/tomchristie/django-rest-framework/blob/restframework2/rest_framework/\1"><span class="label label-info">\1</span></a>'
 
 page = open(os.path.join(docs_dir, 'template.html'), 'r').read()
 

rest_framework/__init__.py

+__version__ = '2.0.0'
+
+VERSION = __version__  # synonym

rest_framework/authentication.py

+"""
+The :mod:`authentication` module provides a set of pluggable authentication classes.
+
+Authentication behavior is provided by mixing the :class:`mixins.RequestMixin` class into a :class:`View` class.
+"""
+
+from django.contrib.auth import authenticate
+from rest_framework.compat import CsrfViewMiddleware
+from rest_framework.authtoken.models import Token
+import base64
+
+
+class BaseAuthentication(object):
+    """
+    All authentication classes should extend BaseAuthentication.
+    """
+
+    def authenticate(self, request):
+        """
+        Authenticate the :obj:`request` and return a :obj:`User` or :const:`None`. [*]_
+
+        .. [*] The authentication context *will* typically be a :obj:`User`,
+            but it need not be.  It can be any user-like object so long as the
+            permissions classes (see the :mod:`permissions` module) on the view can
+            handle the object and use it to determine if the request has the required
+            permissions or not.
+
+            This can be an important distinction if you're implementing some token
+            based authentication mechanism, where the authentication context
+            may be more involved than simply mapping to a :obj:`User`.
+        """
+        return None
+
+
+class BasicAuthentication(BaseAuthentication):
+    """
+    Base class for HTTP Basic authentication.
+    Subclasses should implement `.authenticate_credentials()`.
+    """
+
+    def authenticate(self, request):
+        """
+        Returns a `User` if a correct username and password have been supplied
+        using HTTP Basic authentication.  Otherwise returns `None`.
+        """
+        from django.utils.encoding import smart_unicode, DjangoUnicodeDecodeError
+
+        if 'HTTP_AUTHORIZATION' in request.META:
+            auth = request.META['HTTP_AUTHORIZATION'].split()
+            if len(auth) == 2 and auth[0].lower() == "basic":
+                try:
+                    auth_parts = base64.b64decode(auth[1]).partition(':')
+                except TypeError:
+                    return None
+
+                try:
+                    userid, password = smart_unicode(auth_parts[0]), smart_unicode(auth_parts[2])
+                except DjangoUnicodeDecodeError:
+                    return None
+
+                return self.authenticate_credentials(userid, password)
+
+    def authenticate_credentials(self, userid, password):
+        """
+        Given the Basic authentication userid and password, authenticate
+        and return a user instance.
+        """
+        raise NotImplementedError('.authenticate_credentials() must be overridden')
+
+
+class UserBasicAuthentication(BasicAuthentication):
+    def authenticate_credentials(self, userid, password):
+        """
+        Authenticate the userid and password against username and password.
+        """
+        user = authenticate(username=userid, password=password)
+        if user is not None and user.is_active:
+            return (user, None)
+
+
+class SessionAuthentication(BaseAuthentication):
+    """
+    Use Django's session framework for authentication.
+    """
+
+    def authenticate(self, request):
+        """
+        Returns a :obj:`User` if the request session currently has a logged in user.
+        Otherwise returns :const:`None`.
+        """
+        user = getattr(request._request, 'user', None)
+
+        if user and user.is_active:
+            # Enforce CSRF validation for session based authentication.
+            resp = CsrfViewMiddleware().process_view(request, None, (), {})
+
+            if resp is None:  # csrf passed
+                return (user, None)
+
+
+class TokenAuthentication(BaseAuthentication):
+    """
+    Simple token based authentication.
+
+    Clients should authenticate by passing the token key in the "Authorization"
+    HTTP header, prepended with the string "Token ".  For example:
+
+        Authorization: Token 401f7ac837da42b97f613d789819ff93537bee6a
+    """
+
+    model = Token
+    """
+    A custom token model may be used, but must have the following properties.
+
+    * key -- The string identifying the token
+    * user -- The user to which the token belongs
+    """
+
+    def authenticate(self, request):
+        auth = request.META.get('HTTP_AUTHORIZATION', '').split()
+
+        if len(auth) == 2 and auth[0].lower() == "token":
+            key = auth[1]
+            try:
+                token = self.model.objects.get(key=key)
+            except self.model.DoesNotExist:
+                return None
+
+            if token.user.is_active and not getattr(token, 'revoked', False):
+                return (token.user, token)
+
+# TODO: OAuthAuthentication

rest_framework/authtoken/migrations/0001_initial.py

+# -*- coding: utf-8 -*-
+import datetime
+from south.db import db
+from south.v2 import SchemaMigration
+from django.db import models
+
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        # Adding model 'Token'
+        db.create_table('authtoken_token', (
+            ('key', self.gf('django.db.models.fields.CharField')(max_length=40, primary_key=True)),
+            ('user', self.gf('django.db.models.fields.related.ForeignKey')(to=orm['auth.User'])),
+            ('revoked', self.gf('django.db.models.fields.BooleanField')(default=False)),
+            ('created', self.gf('django.db.models.fields.DateTimeField')(auto_now_add=True, blank=True)),
+        ))
+        db.send_create_signal('authtoken', ['Token'])
+
+
+    def backwards(self, orm):
+        # Deleting model 'Token'
+        db.delete_table('authtoken_token')
+
+
+    models = {
+        'auth.group': {
+            'Meta': {'object_name': 'Group'},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}),
+            'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'})
+        },
+        'auth.permission': {
+            'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'},
+            'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '50'})
+        },
+        'auth.user': {
+            'Meta': {'object_name': 'User'},
+            'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}),
+            'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'groups': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Group']", 'symmetrical': 'False', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}),
+            'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}),
+            'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'})
+        },
+        'authtoken.token': {
+            'Meta': {'object_name': 'Token'},
+            'created': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'blank': 'True'}),
+            'key': ('django.db.models.fields.CharField', [], {'max_length': '40', 'primary_key': 'True'}),
+            'revoked': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']"})
+        },
+        'contenttypes.contenttype': {
+            'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"},
+            'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '100'})
+        }
+    }
+
+    complete_apps = ['authtoken']
\ No newline at end of file

rest_framework/authtoken/models.py

+import uuid
+import hmac
+from hashlib import sha1
+from django.db import models
+
+
+class Token(models.Model):
+    """
+    The default authorization token model.
+    """
+    key = models.CharField(max_length=40, primary_key=True)
+    user = models.ForeignKey('auth.User')
+    revoked = models.BooleanField(default=False)
+    created = models.DateTimeField(auto_now_add=True)
+
+    def save(self, *args, **kwargs):
+        if not self.key:
+            self.key = self.generate_key()
+        return super(Token, self).save(*args, **kwargs)
+
+    def generate_key(self):
+        unique = str(uuid.uuid4())
+        return hmac.new(unique, digestmod=sha1).hexdigest()

rest_framework/decorators.py

+from functools import wraps
+from django.http import Http404
+from django.utils.decorators import available_attrs
+from django.core.exceptions import PermissionDenied
+from rest_framework import exceptions
+from rest_framework import status
+from rest_framework.response import Response
+from rest_framework.request import Request
+from rest_framework.settings import api_settings
+
+
+def api_view(allowed_methods):
+    """
+    Decorator for function based views.
+
+        @api_view(['GET', 'POST'])
+        def my_view(request):
+            # request will be an instance of `Request`
+            # `Response` objects will have .request set automatically
+            # APIException instances will be handled
+    """
+    allowed_methods = [method.upper() for method in allowed_methods]
+
+    def decorator(func):
+        @wraps(func, assigned=available_attrs(func))
+        def inner(request, *args, **kwargs):
+            try:
+
+                request = Request(request)
+
+                if request.method not in allowed_methods:
+                    raise exceptions.MethodNotAllowed(request.method)
+
+                response = func(request, *args, **kwargs)
+
+                if isinstance(response, Response):
+                    response.request = request
+                    if api_settings.FORMAT_SUFFIX_KWARG:
+                        response.format = kwargs.get(api_settings.FORMAT_SUFFIX_KWARG, None)
+                return response
+
+            except exceptions.APIException as exc:
+                return Response({'detail': exc.detail}, status=exc.status_code)
+
+            except Http404 as exc:
+                return Response({'detail': 'Not found'},
+                                status=status.HTTP_404_NOT_FOUND)
+
+            except PermissionDenied as exc:
+                return Response({'detail': 'Permission denied'},
+                                status=status.HTTP_403_FORBIDDEN)
+        return inner
+    return decorator

rest_framework/exceptions.py

+"""
+Handled exceptions raised by REST framework.
+
+In addition Django's built in 403 and 404 exceptions are handled.
+(`django.http.Http404` and `django.core.exceptions.PermissionDenied`)
+"""
+from rest_framework import status
+
+
+class APIException(Exception):
+    """
+    Base class for REST framework exceptions.
+    Subclasses should provide `.status_code` and `.detail` properties.
+    """
+    pass
+
+
+class ParseError(APIException):
+    status_code = status.HTTP_400_BAD_REQUEST
+    default_detail = 'Malformed request.'
+
+    def __init__(self, detail=None):
+        self.detail = detail or self.default_detail
+
+
+class PermissionDenied(APIException):
+    status_code = status.HTTP_403_FORBIDDEN
+    default_detail = 'You do not have permission to perform this action.'
+
+    def __init__(self, detail=None):
+        self.detail = detail or self.default_detail
+
+
+class InvalidFormat(APIException):
+    status_code = status.HTTP_404_NOT_FOUND
+    default_detail = "Format suffix '.%s' not found."
+
+    def __init__(self, format, detail=None):
+        self.detail = (detail or self.default_detail) % format
+
+
+class MethodNotAllowed(APIException):
+    status_code = status.HTTP_405_METHOD_NOT_ALLOWED
+    default_detail = "Method '%s' not allowed."
+
+    def __init__(self, method, detail=None):
+        self.detail = (detail or self.default_detail) % method
+
+
+class NotAcceptable(APIException):
+    status_code = status.HTTP_406_NOT_ACCEPTABLE
+    default_detail = "Could not satisfy the request's Accept header"
+
+    def __init__(self, detail=None, available_renderers=None):
+        self.detail = detail or self.default_detail
+        self.available_renderers = available_renderers
+
+
+class UnsupportedMediaType(APIException):
+    status_code = status.HTTP_415_UNSUPPORTED_MEDIA_TYPE
+    default_detail = "Unsupported media type '%s' in request."
+
+    def __init__(self, media_type, detail=None):
+        self.detail = (detail or self.default_detail) % media_type
+
+
+class Throttled(APIException):
+    status_code = status.HTTP_429_TOO_MANY_REQUESTS
+    default_detail = "Request was throttled."
+    extra_detail = "Expected available in %d second%s."
+
+    def __init__(self, wait=None, detail=None):
+        import math
+        self.wait = wait and math.ceil(wait) or None
+        if wait is not None:
+            format = detail or self.default_detail + self.extra_detail
+            self.detail = format % (self.wait, self.wait != 1 and 's' or '')
+        else:
+            self.detail = detail or self.default_detail

rest_framework/generics.py

+"""
+Generic views that provide commmonly needed behaviour.
+"""
+
+from rest_framework import views, mixins
+from django.views.generic.detail import SingleObjectMixin
+from django.views.generic.list import MultipleObjectMixin
+
+
+### Base classes for the generic views ###
+
+class BaseView(views.APIView):
+    """
+    Base class for all other generic views.
+    """
+    serializer_class = None
+
+    def get_serializer(self, data=None, files=None, instance=None):
+        # TODO: add support for files
+        # TODO: add support for seperate serializer/deserializer
+        context = {
+            'request': self.request,
+            'format': self.kwargs.get('format', None)
+        }
+        return self.serializer_class(data, instance=instance, context=context)
+
+
+class MultipleObjectBaseView(MultipleObjectMixin, BaseView):
+    """
+    Base class for generic views onto a queryset.
+    """
+    pass
+
+
+class SingleObjectBaseView(SingleObjectMixin, BaseView):
+    """
+    Base class for generic views onto a model instance.
+    """
+
+    def get_object(self):
+        """
+        Override default to add support for object-level permissions.
+        """
+        obj = super(SingleObjectBaseView, self).get_object()
+        self.check_permissions(self.request, obj)
+        return obj
+
+
+### Concrete view classes that provide method handlers ###
+### by composing the mixin classes with a base view.   ###
+
+class ListAPIView(mixins.ListModelMixin,
+                  mixins.MetadataMixin,
+                  MultipleObjectBaseView):
+    """
+    Concrete view for listing a queryset.
+    """
+    def get(self, request, *args, **kwargs):
+        return self.list(request, *args, **kwargs)
+
+    def options(self, request, *args, **kwargs):
+        return self.metadata(request, *args, **kwargs)
+
+
+class RootAPIView(mixins.ListModelMixin,
+                  mixins.CreateModelMixin,
+                  mixins.MetadataMixin,
+                  MultipleObjectBaseView):
+    """
+    Concrete view for listing a queryset or creating a model instance.
+    """
+    def get(self, request, *args, **kwargs):
+        return self.list(request, *args, **kwargs)
+
+    def post(self, request, *args, **kwargs):
+        return self.create(request, *args, **kwargs)
+
+    def options(self, request, *args, **kwargs):
+        return self.metadata(request, *args, **kwargs)
+
+
+class DetailAPIView(mixins.RetrieveModelMixin,
+                    mixins.MetadataMixin,
+                    SingleObjectBaseView):
+    """
+    Concrete view for retrieving a model instance.
+    """
+    def get(self, request, *args, **kwargs):
+        return self.retrieve(request, *args, **kwargs)
+
+    def options(self, request, *args, **kwargs):
+        return self.metadata(request, *args, **kwargs)
+
+
+class InstanceAPIView(mixins.RetrieveModelMixin,
+                      mixins.UpdateModelMixin,
+                      mixins.DestroyModelMixin,
+                      mixins.MetadataMixin,
+                      SingleObjectBaseView):
+    """
+    Concrete view for retrieving, updating or deleting a model instance.
+    """
+    def get(self, request, *args, **kwargs):
+        return self.retrieve(request, *args, **kwargs)
+
+    def put(self, request, *args, **kwargs):
+        return self.update(request, *args, **kwargs)
+
+    def delete(self, request, *args, **kwargs):
+        return self.destroy(request, *args, **kwargs)
+
+    def options(self, request, *args, **kwargs):
+        return self.metadata(request, *args, **kwargs)

rest_framework/mixins.py

+"""
+Basic building blocks for generic class based views.
+
+We don't bind behaviour to http method handlers yet,
+which allows mixin classes to be composed in interesting ways.
+
+Eg. Use mixins to build a Resource class, and have a Router class
+    perform the binding of http methods to actions for us.
+"""
+from rest_framework import status
+from rest_framework.response import Response
+
+
+class CreateModelMixin(object):
+    """
+    Create a model instance.
+    Should be mixed in with any `BaseView`.
+    """
+    def create(self, request, *args, **kwargs):
+        serializer = self.get_serializer(data=request.DATA)
+        if serializer.is_valid():
+            self.object = serializer.object
+            self.object.save()
+            return Response(serializer.data, status=status.HTTP_201_CREATED)
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+
+class ListModelMixin(object):
+    """
+    List a queryset.
+    Should be mixed in with `MultipleObjectBaseView`.
+    """
+    def list(self, request, *args, **kwargs):
+        self.object_list = self.get_queryset()
+        serializer = self.get_serializer(instance=self.object_list)
+        return Response(serializer.data)
+
+
+class RetrieveModelMixin(object):
+    """
+    Retrieve a model instance.
+    Should be mixed in with `SingleObjectBaseView`.
+    """
+    def retrieve(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        serializer = self.get_serializer(instance=self.object)
+        return Response(serializer.data)
+
+
+class UpdateModelMixin(object):
+    """
+    Update a model instance.
+    Should be mixed in with `SingleObjectBaseView`.
+    """
+    def update(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        serializer = self.get_serializer(data=request.DATA, instance=self.object)
+        if serializer.is_valid():
+            self.object = serializer.object
+            self.object.save()
+            return Response(serializer.data)
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+
+class DestroyModelMixin(object):
+    """
+    Destroy a model instance.
+    Should be mixed in with `SingleObjectBaseView`.
+    """
+    def destroy(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        self.object.delete()
+        return Response(status=status.HTTP_204_NO_CONTENT)
+
+
+class MetadataMixin(object):
+    """
+    Return a dicitonary of view metadata.
+    Should be mixed in with any `BaseView`.
+
+    This mixin is typically used for the HTTP 'OPTIONS' method.
+    """
+    def metadata(self, request, *args, **kwargs):
+        content = {
+            'name': self.get_name(),
+            'description': self.get_description(),
+            'renders': self._rendered_media_types,
+            'parses': self._parsed_media_types,
+        }
+        #  TODO: Add 'fields', from serializer info.
+        # form = self.get_bound_form()
+        # if form is not None:
+        #     field_name_types = {}
+        #     for name, field in form.fields.iteritems():
+        #         field_name_types[name] = field.__class__.__name__
+        #     content['fields'] = field_name_types
+        return Response(content, status=status.HTTP_200_OK)

rest_framework/models.py

+# Just to keep things like ./manage.py test happy

rest_framework/negotiation.py

+from rest_framework import exceptions
+from rest_framework.settings import api_settings
+from rest_framework.utils.mediatypes import order_by_precedence
+
+
+class BaseContentNegotiation(object):
+    def negotiate(self, request, renderers, format=None, force=False):
+        raise NotImplementedError('.negotiate() must be implemented')
+
+
+class DefaultContentNegotiation(object):
+    settings = api_settings
+
+    def negotiate(self, request, renderers, format=None, force=False):
+        """
+        Given a request and a list of renderers, return a two-tuple of:
+        (renderer, media type).
+
+        If force is set, then suppress exceptions, and forcibly return a
+        fallback renderer and media_type.
+        """
+        try:
+            return self.unforced_negotiate(request, renderers, format)
+        except (exceptions.InvalidFormat, exceptions.NotAcceptable):
+            if force:
+                return (renderers[0], renderers[0].media_type)
+            raise
+
+    def unforced_negotiate(self, request, renderers, format=None):
+        """
+        As `.negotiate()`, but does not take the optional `force` agument,
+        or suppress exceptions.
+        """
+        # Allow URL style format override.  eg. "?format=json
+        format = format or request.GET.get(self.settings.URL_FORMAT_OVERRIDE)
+
+        if format:
+            renderers = self.filter_renderers(renderers, format)
+
+        accepts = self.get_accept_list(request)
+
+        # Check the acceptable media types against each renderer,
+        # attempting more specific media types first
+        # NB. The inner loop here isn't as bad as it first looks :)
+        #     Worst case is we're looping over len(accept_list) * len(self.renderers)
+        for media_type_set in order_by_precedence(accepts):
+            for renderer in renderers:
+                for media_type in media_type_set:
+                    if renderer.can_handle_media_type(media_type):
+                        return renderer, media_type
+
+        raise exceptions.NotAcceptable(available_renderers=renderers)
+
+    def filter_renderers(self, renderers, format):
+        """
+        If there is a '.json' style format suffix, filter the renderers
+        so that we only negotiation against those that accept that format.
+        """
+        renderers = [renderer for renderer in renderers
+                     if renderer.can_handle_format(format)]
+        if not renderers:
+            raise exceptions.InvalidFormat(format)
+        return renderers
+
+    def get_accept_list(self, request):
+        """
+        Given the incoming request, return a tokenised list of media
+        type strings.
+
+        Allows URL style accept override.  eg. "?accept=application/json"
+        """
+        header = request.META.get('HTTP_ACCEPT', '*/*')
+        header = request.GET.get(self.settings.URL_ACCEPT_OVERRIDE, header)
+        return [token.strip() for token in header.split(',')]

rest_framework/parsers.py

+"""
+Django supports parsing the content of an HTTP request, but only for form POST requests.
+That behavior is sufficient for dealing with standard HTML forms, but it doesn't map well
+to general HTTP requests.
+
+We need a method to be able to:
+
+1.) Determine the parsed content on a request for methods other than POST (eg typically also PUT)
+
+2.) Determine the parsed content on a request for media types other than application/x-www-form-urlencoded
+   and multipart/form-data.  (eg also handle multipart/json)
+"""
+
+from django.http import QueryDict
+from django.http.multipartparser import MultiPartParser as DjangoMultiPartParser
+from django.http.multipartparser import MultiPartParserError
+from django.utils import simplejson as json
+from rest_framework.compat import yaml
+from rest_framework.exceptions import ParseError
+from rest_framework.utils.mediatypes import media_type_matches
+from xml.etree import ElementTree as ET
+from rest_framework.compat import ETParseError
+from xml.parsers.expat import ExpatError
+import datetime
+import decimal
+from io import BytesIO
+
+
+__all__ = (
+    'BaseParser',
+    'JSONParser',
+    'PlainTextParser',
+    'FormParser',
+    'MultiPartParser',
+    'YAMLParser',
+    'XMLParser'
+)
+
+
+class DataAndFiles(object):
+    def __init__(self, data, files):
+        self.data = data
+        self.files = files
+
+
+class BaseParser(object):
+    """
+    All parsers should extend :class:`BaseParser`, specifying a :attr:`media_type` attribute,
+    and overriding the :meth:`parse` method.
+    """
+
+    media_type = None
+
+    def can_handle_request(self, content_type):
+        """
+        Returns :const:`True` if this parser is able to deal with the given *content_type*.
+
+        The default implementation for this function is to check the *content_type*
+        argument against the :attr:`media_type` attribute set on the class to see if
+        they match.
+
+        This may be overridden to provide for other behavior, but typically you'll
+        instead want to just set the :attr:`media_type` attribute on the class.
+        """
+        return media_type_matches(self.media_type, content_type)
+
+    def parse(self, string_or_stream, **opts):
+        """
+        The main entry point to parsers.  This is a light wrapper around
+        `parse_stream`, that instead handles both string and stream objects.
+        """
+        if isinstance(string_or_stream, basestring):
+            stream = BytesIO(string_or_stream)
+        else:
+            stream = string_or_stream
+        return self.parse_stream(stream, **opts)
+
+    def parse_stream(self, stream, **opts):
+        """
+        Given a *stream* to read from, return the deserialized output.
+        Should return parsed data, or a DataAndFiles object consisting of the
+        parsed data and files.
+        """
+        raise NotImplementedError(".parse_stream() must be overridden.")
+
+
+class JSONParser(BaseParser):
+    """
+    Parses JSON-serialized data.
+    """
+
+    media_type = 'application/json'
+
+    def parse_stream(self, stream, **opts):
+        """
+        Returns a 2-tuple of `(data, files)`.
+
+        `data` will be an object which is the parsed content of the response.
+        `files` will always be `None`.
+        """
+        try:
+            return json.load(stream)
+        except ValueError, exc:
+            raise ParseError('JSON parse error - %s' % unicode(exc))
+
+
+class YAMLParser(BaseParser):
+    """
+    Parses YAML-serialized data.
+    """
+
+    media_type = 'application/yaml'
+
+    def parse_stream(self, stream, **opts):
+        """
+        Returns a 2-tuple of `(data, files)`.
+
+        `data` will be an object which is the parsed content of the response.
+        `files` will always be `None`.
+        """
+        try:
+            return yaml.safe_load(stream)
+        except (ValueError, yaml.parser.ParserError), exc:
+            raise ParseError('YAML parse error - %s' % unicode(exc))
+
+
+class PlainTextParser(BaseParser):
+    """
+    Plain text parser.
+    """
+
+    media_type = 'text/plain'
+
+    def parse_stream(self, stream, **opts):
+        """
+        Returns a 2-tuple of `(data, files)`.
+
+        `data` will simply be a string representing the body of the request.
+        `files` will always be `None`.
+        """
+        return stream.read()
+
+
+class FormParser(BaseParser):
+    """
+    Parser for form data.
+    """
+
+    media_type = 'application/x-www-form-urlencoded'
+
+    def parse_stream(self, stream, **opts):
+        """
+        Returns a 2-tuple of `(data, files)`.
+
+        `data` will be a :class:`QueryDict` containing all the form parameters.
+        `files` will always be :const:`None`.
+        """
+        data = QueryDict(stream.read())
+        return data
+
+
+class MultiPartParser(BaseParser):
+    """
+    Parser for multipart form data, which may include file data.
+    """
+
+    media_type = 'multipart/form-data'
+
+    def parse_stream(self, stream, **opts):
+        """
+        Returns a DataAndFiles object.
+
+        `.data` will be a `QueryDict` containing all the form parameters.
+        `.files` will be a `QueryDict` containing all the form files.
+        """
+        meta = opts['meta']
+        upload_handlers = opts['upload_handlers']
+        try:
+            parser = DjangoMultiPartParser(meta, stream, upload_handlers)
+            data, files = parser.parse()
+            return DataAndFiles(data, files)
+        except MultiPartParserError, exc:
+            raise ParseError('Multipart form parse error - %s' % unicode(exc))
+
+
+class XMLParser(BaseParser):
+    """
+    XML parser.
+    """
+
+    media_type = 'application/xml'
+
+    def parse_stream(self, stream, **opts):
+        try:
+            tree = ET.parse(stream)
+        except (ExpatError, ETParseError, ValueError), exc:
+            raise ParseError('XML parse error - %s' % unicode(exc))
+        data = self._xml_convert(tree.getroot())
+
+        return data
+
+    def _xml_convert(self, element):
+        """
+        convert the xml `element` into the corresponding python object
+        """
+
+        children = element.getchildren()
+
+        if len(children) == 0:
+            return self._type_convert(element.text)
+        else:
+            # if the fist child tag is list-item means all children are list-item
+            if children[0].tag == "list-item":
+                data = []
+                for child in children:
+                    data.append(self._xml_convert(child))
+            else:
+                data = {}
+                for child in children:
+                    data[child.tag] = self._xml_convert(child)
+
+            return data
+
+    def _type_convert(self, value):
+        """
+        Converts the value returned by the XMl parse into the equivalent
+        Python type
+        """
+        if value is None:
+            return value
+
+        try:
+            return datetime.datetime.strptime(value, '%Y-%m-%d %H:%M:%S')
+        except ValueError:
+            pass
+
+        try:
+            return int(value)
+        except ValueError:
+            pass
+
+        try:
+            return decimal.Decimal(value)
+        except decimal.InvalidOperation:
+            pass
+
+        return value
+
+
+DEFAULT_PARSERS = (
+    JSONParser,
+    FormParser,
+    MultiPartParser,
+    XMLParser
+)
+
+if yaml:
+    DEFAULT_PARSERS += (YAMLParser, )
+else:
+    YAMLParser = None

rest_framework/permissions.py

+"""
+The :mod:`permissions` module bundles a set of permission classes that are used
+for checking if a request passes a certain set of constraints.
+
+Permission behavior is provided by mixing the :class:`mixins.PermissionsMixin` class into a :class:`View` class.
+"""
+
+__all__ = (
+    'BasePermission',
+    'FullAnonAccess',
+    'IsAuthenticated',
+    'IsAdminUser',
+    'IsUserOrIsAnonReadOnly',
+    'PerUserThrottling',
+    'PerViewThrottling',
+)
+
+SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS']
+
+
+class BasePermission(object):
+    """
+    A base class from which all permission classes should inherit.
+    """
+    def __init__(self, view):
+        """
+        Permission classes are always passed the current view on creation.
+        """
+        self.view = view
+
+    def has_permission(self, request, obj=None):
+        """
+        Should simply return, or raise an :exc:`response.ImmediateResponse`.
+        """
+        raise NotImplementedError(".has_permission() must be overridden.")
+
+
+class IsAuthenticated(BasePermission):
+    """
+    Allows access only to authenticated users.
+    """
+
+    def has_permission(self, request, obj=None):
+        if request.user and request.user.is_authenticated():
+            return True
+        return False
+
+
+class IsAdminUser(BasePermission):
+    """
+    Allows access only to admin users.
+    """
+
+    def has_permission(self, request, obj=None):
+        if request.user and request.user.is_staff:
+            return True
+        return False
+
+
+class IsAuthenticatedOrReadOnly(BasePermission):
+    """
+    The request is authenticated as a user, or is a read-only request.
+    """
+
+    def has_permission(self, request, obj=None):
+        if (request.method in SAFE_METHODS or
+            request.user and
+            request.user.is_authenticated()):
+            return True
+        return False
+
+
+class DjangoModelPermissions(BasePermission):
+    """
+    The request is authenticated using `django.contrib.auth` permissions.
+    See: https://docs.djangoproject.com/en/dev/topics/auth/#permissions
+
+    It ensures that the user is authenticated, and has the appropriate
+    `add`/`change`/`delete` permissions on the model.
+
+    This permission should only be used on views with a `ModelResource`.
+    """
+
+    # Map methods into required permission codes.
+    # Override this if you need to also provide 'view' permissions,
+    # or if you want to provide custom permission codes.
+    perms_map = {
+        'GET': [],
+        'OPTIONS': [],
+        'HEAD': [],
+        'POST': ['%(app_label)s.add_%(model_name)s'],
+        'PUT': ['%(app_label)s.change_%(model_name)s'],
+        'PATCH': ['%(app_label)s.change_%(model_name)s'],
+        'DELETE': ['%(app_label)s.delete_%(model_name)s'],
+    }
+
+    def get_required_permissions(self, method, model_cls):
+        """
+        Given a model and an HTTP method, return the list of permission
+        codes that the user is required to have.
+        """
+        kwargs = {
+            'app_label': model_cls._meta.app_label,
+            'model_name':  model_cls._meta.module_name
+        }
+        return [perm % kwargs for perm in self.perms_map[method]]
+
+    def has_permission(self, request, obj=None):
+        model_cls = self.view.model
+        perms = self.get_required_permissions(request.method, model_cls)
+
+        if (request.user and
+            request.user.is_authenticated() and
+            request.user.has_perms(perms, obj)):
+            return True
+        return False

rest_framework/request.py

+"""
+The :mod:`request` module provides a :class:`Request` class used to wrap the standard `request`
+object received in all the views.
+
+The wrapped request then offers a richer API, in particular :
+
+    - content automatically parsed according to `Content-Type` header,
+      and available as :meth:`.DATA<Request.DATA>`
+    - full support of PUT method, including support for file uploads
+    - form overloading of HTTP method, content type and content
+"""
+from StringIO import StringIO
+
+from rest_framework import exceptions
+from rest_framework.settings import api_settings
+from rest_framework.utils.mediatypes import is_form_media_type
+
+
+__all__ = ('Request',)
+
+
+class Empty(object):
+    """
+    Placeholder for unset attributes.
+    Cannot use `None`, as that may be a valid value.
+    """
+    pass
+
+
+def _hasattr(obj, name):
+    return not getattr(obj, name) is Empty
+
+
+class Request(object):
+    """
+    Wrapper allowing to enhance a standard `HttpRequest` instance.
+
+    Kwargs:
+        - request(HttpRequest). The original request instance.
+        - parsers_classes(list/tuple). The parsers to use for parsing the
+          request content.
+        - authentication_classes(list/tuple). The authentications used to try
+          authenticating the request's user.
+    """
+
+    _METHOD_PARAM = api_settings.FORM_METHOD_OVERRIDE
+    _CONTENT_PARAM = api_settings.FORM_CONTENT_OVERRIDE
+    _CONTENTTYPE_PARAM = api_settings.FORM_CONTENTTYPE_OVERRIDE
+
+    def __init__(self, request, parser_classes=None, authentication_classes=None):
+        self._request = request
+        self.parser_classes = parser_classes or ()
+        self.authentication_classes = authentication_classes or ()
+        self._data = Empty
+        self._files = Empty
+        self._method = Empty
+        self._content_type = Empty
+        self._stream = Empty
+
+    def get_parsers(self):
+        """
+        Instantiates and returns the list of parsers the request will use.
+        """
+        return [parser() for parser in self.parser_classes]
+
+    def get_authentications(self):
+        """
+        Instantiates and returns the list of parsers the request will use.
+        """
+        return [authentication() for authentication in self.authentication_classes]
+
+    @property
+    def method(self):
+        """
+        Returns the HTTP method.
+
+        This allows the `method` to be overridden by using a hidden `form`
+        field on a form POST request.
+        """
+        if not _hasattr(self, '_method'):
+            self._load_method_and_content_type()
+        return self._method
+
+    @property
+    def content_type(self):
+        """
+        Returns the content type header.
+
+        This should be used instead of ``request.META.get('HTTP_CONTENT_TYPE')``,
+        as it allows the content type to be overridden by using a hidden form
+        field on a form POST request.
+        """
+        if not _hasattr(self, '_content_type'):
+            self._load_method_and_content_type()
+        return self._content_type
+
+    @property
+    def stream(self):
+        """
+        Returns an object that may be used to stream the request content.
+        """
+        if not _hasattr(self, '_stream'):
+            self._load_stream()
+        return self._stream
+
+    @property
+    def DATA(self):
+        """
+        Parses the request body and returns the data.
+
+        Similar to usual behaviour of `request.POST`, except that it handles
+        arbitrary parsers, and also works on methods other than POST (eg PUT).
+        """
+        if not _hasattr(self, '_data'):
+            self._load_data_and_files()
+        return self._data
+
+    @property
+    def FILES(self):
+        """
+        Parses the request body and returns any files uploaded in the request.
+
+        Similar to usual behaviour of `request.FILES`, except that it handles
+        arbitrary parsers, and also works on methods other than POST (eg PUT).
+        """
+        if not _hasattr(self, '_files'):
+            self._load_data_and_files()
+        return self._files
+
+    @property
+    def user(self):
+        """
+        Returns the user associated with the current request, as authenticated
+        by the authentication classes provided to the request.
+        """
+        if not hasattr(self, '_user'):
+            self._user, self._auth = self._authenticate()
+        return self._user
+
+    @property
+    def auth(self):
+        """
+        Returns any non-user authentication information associated with the
+        request, such as an authentication token.
+        """
+        if not hasattr(self, '_auth'):
+            self._user, self._auth = self._authenticate()
+        return self._auth
+
+    def _load_data_and_files(self):
+        """
+        Parses the request content into self.DATA and self.FILES.
+        """
+        if not _hasattr(self, '_content_type'):
+            self._load_method_and_content_type()
+
+        if not _hasattr(self, '_data'):
+            self._data, self._files = self._parse()
+
+    def _load_method_and_content_type(self):
+        """
+        Sets the method and content_type, and then check if they've
+        been overridden.
+        """
+        self._content_type = self.META.get('HTTP_CONTENT_TYPE',
+                                           self.META.get('CONTENT_TYPE', ''))
+        self._perform_form_overloading()
+        # if the HTTP method was not overloaded, we take the raw HTTP method
+        if not _hasattr(self, '_method'):
+            self._method = self._request.method
+
+    def _load_stream(self):
+        """
+        Return the content body of the request, as a stream.
+        """
+        try:
+            content_length = int(self.META.get('CONTENT_LENGTH',
+                                    self.META.get('HTTP_CONTENT_LENGTH')))
+        except (ValueError, TypeError):
+            content_length = 0
+
+        if content_length == 0:
+            self._stream = None
+        elif hasattr(self._request, 'read'):
+            self._stream = self._request
+        else:
+            self._stream = StringIO(self.raw_post_data)
+
+    def _perform_form_overloading(self):
+        """
+        If this is a form POST request, then we need to check if the method and
+        content/content_type have been overridden by setting them in hidden
+        form fields or not.
+        """
+
+        USE_FORM_OVERLOADING = (
+            self._METHOD_PARAM or
+            (self._CONTENT_PARAM and self._CONTENTTYPE_PARAM)
+        )
+
+        # We only need to use form overloading on form POST requests.
+        if (not USE_FORM_OVERLOADING
+            or self._request.method != 'POST'
+            or not is_form_media_type(self._content_type)):
+            return
+
+        # At this point we're committed to parsing the request as form data.
+        self._data = self._request.POST
+        self._files = self._request.FILES
+
+        # Method overloading - change the method and remove the param from the content.
+        if (self._METHOD_PARAM and
+            self._METHOD_PARAM in self._data):
+            self._method = self._data[self._METHOD_PARAM].upper()
+            self._data.pop(self._METHOD_PARAM)
+
+        # Content overloading - modify the content type, and re-parse.
+        if (self._CONTENT_PARAM and
+            self._CONTENTTYPE_PARAM and
+            self._CONTENT_PARAM in self._data and
+            self._CONTENTTYPE_PARAM in self._data):
+            self._content_type = self._data[self._CONTENTTYPE_PARAM]
+            self._stream = StringIO(self._data[self._CONTENT_PARAM])
+            self._data.pop(self._CONTENTTYPE_PARAM)
+            self._data.pop(self._CONTENT_PARAM)
+            self._data, self._files = self._parse()
+
+    def _parse(self):
+        """
+        Parse the request content, returning a two-tuple of (data, files)
+
+        May raise an `UnsupportedMediaType`, or `ParseError` exception.
+        """
+        if self.stream is None or self.content_type is None:
+            return (None, None)
+
+        for parser in self.get_parsers():
+            if parser.can_handle_request(self.content_type):
+                parsed = parser.parse(self.stream, meta=self.META,
+                                      upload_handlers=self.upload_handlers)
+                # Parser classes may return the raw data, or a
+                # DataAndFiles object.  Unpack the result as required.
+                try:
+                    return (parsed.data, parsed.files)
+                except AttributeError:
+                    return (parsed, None)
+
+        raise exceptions.UnsupportedMediaType(self._content_type)
+
+    def _authenticate(self):
+        """
+        Attempt to authenticate the request using each authentication instance in turn.
+        Returns a two-tuple of (user, authtoken).
+        """
+        for authentication in self.get_authentications():
+            user_auth_tuple = authentication.authenticate(self)
+            if not user_auth_tuple is None:
+                return user_auth_tuple
+        return self._not_authenticated()
+
+    def _not_authenticated(self):
+        """
+        Return a two-tuple of (user, authtoken), representing an
+        unauthenticated request.
+
+        By default this will be (AnonymousUser, None).
+        """
+        if api_settings.UNAUTHENTICATED_USER:
+            user = api_settings.UNAUTHENTICATED_USER()
+        else:
+            user = None
+
+        if api_settings.UNAUTHENTICATED_TOKEN:
+            auth = api_settings.UNAUTHENTICATED_TOKEN()
+        else:
+            auth = None
+
+        return (user, auth)
+
+    def __getattr__(self, attr):
+        """
+        Proxy other attributes to the underlying HttpRequest object.
+        """
+        return getattr(self._request, attr)

rest_framework/resources.py

+from functools import update_wrapper
+import inspect
+from django.utils.decorators import classonlymethod
+from djanorestframework import views, generics
+
+
+def wrapped(source, dest):
+    """
+    Copy public, non-method attributes from source to dest, and return dest.
+    """
+    for attr in [attr for attr in dir(source)
+                 if not attr.startswith('_') and not inspect.ismethod(attr)]:
+        setattr(dest, attr, getattr(source, attr))
+    return dest
+
+
+class ResourceMixin(object):
+    """
+    Clone Django's `View.as_view()` behaviour *except* using REST framework's
+    'method -> action' binding for resources.
+    """
+
+    @classonlymethod
+    def as_view(cls, actions, **initkwargs):
+        """
+        Main entry point for a request-response process.
+        """
+        # sanitize keyword arguments
+        for key in initkwargs:
+            if key in cls.http_method_names:
+                raise TypeError("You tried to pass in the %s method name as a "
+                                "keyword argument to %s(). Don't do that."
+                                % (key, cls.__name__))
+            if not hasattr(cls, key):
+                raise TypeError("%s() received an invalid keyword %r" % (
+                    cls.__name__, key))
+
+        def view(request, *args, **kwargs):
+            self = cls(**initkwargs)
+
+            # Bind methods to actions
+            for method, action in actions.items():
+                handler = getattr(self, action)
+                setattr(self, method, handler)
+
+            # As you were, solider.
+            if hasattr(self, 'get') and not hasattr(self, 'head'):
+                self.head = self.get
+            return self.dispatch(request, *args, **kwargs)
+
+        # take name and docstring from class
+        update_wrapper(view, cls, updated=())
+
+        # and possible attributes set by decorators
+        # like csrf_exempt from dispatch
+        update_wrapper(view, cls.dispatch, assigned=())
+        return view
+
+
+class Resource(ResourceMixin, views.APIView):
+    pass
+
+
+class ModelResource(ResourceMixin, views.APIView):
+    root_class = generics.RootAPIView
+    detail_class = generics.InstanceAPIView
+
+    def root_view(self):
+        return wrapped(self, self.root_class())
+
+    def detail_view(self):
+        return wrapped(self, self.detail_class())
+
+    def list(self, request, *args, **kwargs):
+        return self.root_view().list(request, args, kwargs)
+
+    def create(self, request, *args, **kwargs):
+        return self.root_view().create(request, args, kwargs)
+
+    def retrieve(self, request, *args, **kwargs):
+        return self.detail_view().retrieve(request, args, kwargs)
+
+    def update(self, request, *args, **kwargs):
+        return self.detail_view().update(request, args, kwargs)
+
+    def destroy(self, request, *args, **kwargs):
+        return self.detail_view().destroy(request, args, kwargs)

rest_framework/response.py

+from django.template.response import SimpleTemplateResponse
+from django.core.handlers.wsgi import STATUS_CODE_TEXT
+
+
+class Response(SimpleTemplateResponse):
+    """
+    An HttpResponse that allows it's data to be rendered into
+    arbitrary media types.
+    """
+
+    def __init__(self, data=None, status=None, headers=None,
+                 renderer=None, media_type=None):
+        """
+        Alters the init arguments slightly.
+        For example, drop 'template_name', and instead use 'data'.
+
+        Setting 'renderer' and 'media_type' will typically be defered,
+        For example being set automatically by the `APIView`.
+        """
+        super(Response, self).__init__(None, status=status)
+        self.data = data
+        self.headers = headers and headers[:] or []
+        self.renderer = renderer
+        self.media_type = media_type
+
+    @property
+    def rendered_content(self):
+        self['Content-Type'] = self.renderer.media_type
+        if self.data is None:
+            return self.renderer.render()
+        return self.renderer.render(self.data, self.media_type)
+
+    @property
+    def status_text(self):
+        """
+        Returns reason text corresponding to our HTTP response status code.
+        Provided for convenience.
+        """
+        return STATUS_CODE_TEXT.get(self.status_code, '')

rest_framework/reverse.py

+"""
+Provide reverse functions that return fully qualified URLs
+"""
+from django.core.urlresolvers import reverse as django_reverse
+from django.utils.functional import lazy
+
+
+def reverse(viewname, *args, **kwargs):
+    """
+    Same as `django.core.urlresolvers.reverse`, but optionally takes a request
+    and returns a fully qualified URL, using the request to get the base URL.
+    """
+    request = kwargs.pop('request', None)
+    url = django_reverse(viewname, *args, **kwargs)
+    if request:
+        return request.build_absolute_uri(url)
+    return url
+
+
+reverse_lazy = lazy(reverse, str)

rest_framework/runtests/runcoverage.py

+#!/usr/bin/env python
+"""
+Useful tool to run the test suite for rest_framework and generate a coverage report.
+"""
+
+# http://ericholscher.com/blog/2009/jun/29/enable-setuppy-test-your-django-apps/
+# http://www.travisswicegood.com/2010/01/17/django-virtualenv-pip-and-fabric/
+# http://code.djangoproject.com/svn/django/trunk/tests/runtests.py
+import os
+import sys
+os.environ['DJANGO_SETTINGS_MODULE'] = 'rest_framework.runtests.settings'
+
+from coverage import coverage
+
+
+def main():
+    """Run the tests for rest_framework and generate a coverage report."""
+
+    cov = coverage()
+    cov.erase()
+    cov.start()
+
+    from django.conf import settings
+    from django.test.utils import get_runner
+    TestRunner = get_runner(settings)
+
+    if hasattr(TestRunner, 'func_name'):
+        # Pre 1.2 test runners were just functions,
+        # and did not support the 'failfast' option.
+        import warnings
+        warnings.warn(
+            'Function-based test runners are deprecated. Test runners should be classes with a run_tests() method.',
+            DeprecationWarning
+        )
+        failures = TestRunner(['rest_framework'])
+    else:
+        test_runner = TestRunner()
+        failures = test_runner.run_tests(['rest_framework'])
+    cov.stop()
+
+    # Discover the list of all modules that we should test coverage for
+    import rest_framework
+
+    project_dir = os.path.dirname(rest_framework.__file__)
+    cov_files = []
+
+    for (path, dirs, files) in os.walk(project_dir):
+        # Drop tests and runtests directories from the test coverage report
+        if os.path.basename(path) == 'tests' or os.path.basename(path) == 'runtests':
+            continue
+
+        # Drop the compat module from coverage, since we're not interested in the coverage
+        # of a module which is specifically for resolving environment dependant imports.
+        # (Because we'll end up getting different coverage reports for it for each environment)
+        if 'compat.py' in files:
+            files.remove('compat.py')
+
+        cov_files.extend([os.path.join(path, file) for file in files if file.endswith('.py')])
+
+    cov.report(cov_files)
+    if '--html' in sys.argv:
+        cov.html_report(cov_files, directory='coverage')
+    sys.exit(failures)
+
+if __name__ == '__main__':
+    main()

rest_framework/runtests/runtests.py

+#!/usr/bin/env python
+
+# http://ericholscher.com/blog/2009/jun/29/enable-setuppy-test-your-django-apps/
+# http://www.travisswicegood.com/2010/01/17/django-virtualenv-pip-and-fabric/
+# http://code.djangoproject.com/svn/django/trunk/tests/runtests.py
+import os
+import sys
+os.environ['DJANGO_SETTINGS_MODULE'] = 'rest_framework.runtests.settings'
+
+from django.conf import settings
+from django.test.utils import get_runner
+
+
+def usage():
+    return """
+    Usage: python runtests.py [UnitTestClass].[method]
+
+    You can pass the Class name of the `UnitTestClass` you want to test.
+
+    Append a method name if you only want to test a specific method of that class.
+    """
+
+
+def main():
+    TestRunner = get_runner(settings)
+
+    test_runner = TestRunner()
+    if len(sys.argv) == 2:
+        test_case = '.' + sys.argv[1]
+    elif len(sys.argv) == 1:
+        test_case = ''
+    else:
+        print usage()
+        sys.exit(1)
+    failures = test_runner.run_tests(['rest_framework' + test_case])
+
+    sys.exit(failures)
+
+if __name__ == '__main__':
+    main()

rest_framework/runtests/settings.py

+# Django settings for testproject project.
+
+DEBUG = True
+TEMPLATE_DEBUG = DEBUG
+DEBUG_PROPAGATE_EXCEPTIONS = True
+
+ADMINS = (
+    # ('Your Name', 'your_email@domain.com'),
+)
+
+MANAGERS = ADMINS
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',  # Add 'postgresql_psycopg2', 'postgresql', 'mysql', 'sqlite3' or 'oracle'.
+        'NAME': 'sqlite.db',                     # Or path to database file if using sqlite3.
+        'USER': '',                      # Not used with sqlite3.
+        'PASSWORD': '',                  # Not used with sqlite3.
+        'HOST': '',                      # Set to empty string for localhost. Not used with sqlite3.
+        'PORT': '',                      # Set to empty string for default. Not used with sqlite3.
+    }
+}
+
+# Local time zone for this installation. Choices can be found here:
+# http://en.wikipedia.org/wiki/List_of_tz_zones_by_name
+# although not all choices may be available on all operating systems.
+# On Unix systems, a value of None will cause Django to use the same
+# timezone as the operating system.
+# If running in a Windows environment this must be set to the same as your
+# system time zone.
+TIME_ZONE = 'Europe/London'
+
+# Language code for this installation. All choices can be found here:
+# http://www.i18nguy.com/unicode/language-identifiers.html
+LANGUAGE_CODE = 'en-uk'
+
+SITE_ID = 1
+
+# If you set this to False, Django will make some optimizations so as not
+# to load the internationalization machinery.
+USE_I18N = True
+
+# If you set this to False, Django will not format dates, numbers and
+# calendars according to the current locale
+USE_L10N = True
+
+# Absolute filesystem path to the directory that will hold user-uploaded files.
+# Example: "/home/media/media.lawrence.com/"
+MEDIA_ROOT = ''
+
+# URL that handles the media served from MEDIA_ROOT. Make sure to use a
+# trailing slash if there is a path component (optional in other cases).
+# Examples: "http://media.lawrence.com", "http://example.com/media/"
+MEDIA_URL = ''
+
+# Make this unique, and don't share it with anybody.
+SECRET_KEY = 'u@x-aj9(hoh#rb-^ymf#g2jx_hp0vj7u5#b@ag1n^seu9e!%cy'
+
+# List of callables that know how to import templates from various sources.
+TEMPLATE_LOADERS = (
+    'django.template.loaders.filesystem.Loader',
+    'django.template.loaders.app_directories.Loader',
+#     'django.template.loaders.eggs.Loader',
+)
+
+MIDDLEWARE_CLASSES = (
+    'django.middleware.common.CommonMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+)
+
+ROOT_URLCONF = 'urls'
+
+TEMPLATE_DIRS = (
+    # Put strings here, like "/home/html/django_templates" or "C:/www/django/templates".
+    # Always use forward slashes, even on Windows.
+    # Don't forget to use absolute paths, not relative paths.
+)
+
+INSTALLED_APPS = (
+    'django.contrib.auth',
+    'django.contrib.contenttypes',
+    'django.contrib.sessions',
+    'django.contrib.sites',
+    'django.contrib.messages',
+    # Uncomment the next line to enable the admin:
+    # 'django.contrib.admin',
+    # Uncomment the next line to enable admin documentation:
+    # 'django.contrib.admindocs',
+    'rest_framework',
+    'rest_framework.authtoken',
+)
+
+STATIC_URL = '/static/'
+
+import django
+
+if django.VERSION < (1, 3):
+    INSTALLED_APPS += ('staticfiles',)
+
+
+# OAuth support is optional, so we only test oauth if it's installed.
+try:
+    import oauth_provider
+except ImportError:
+    pass
+else:
+    INSTALLED_APPS += ('oauth_provider',)
+
+# If we're running on the Jenkins server we want to archive the coverage reports as XML.
+import os
+if os.environ.get('HUDSON_URL', None):
+    TEST_RUNNER = 'xmlrunner.extra.djangotestrunner.XMLTestRunner'
+    TEST_OUTPUT_VERBOSE = True
+    TEST_OUTPUT_DESCRIPTIONS = True
+    TEST_OUTPUT_DIR = 'xmlrunner'

rest_framework/runtests/urls.py

+"""
+Blank URLConf just to keep runtests.py happy.
+"""
+from django.conf.urls.defaults import *
+
+urlpatterns = patterns('',
+)

rest_framework/settings.py

+"""
+Settings for REST framework are all namespaced in the REST_FRAMEWORK setting.
+For example your project's `settings.py` file might look like this:
+
+REST_FRAMEWORK = {
+    'DEFAULT_RENDERERS': (
+        'rest_framework.renderers.JSONRenderer',
+        'rest_framework.renderers.YAMLRenderer',
+    )
+    'DEFAULT_PARSERS': (
+        'rest_framework.parsers.JSONParser',
+        'rest_framework.parsers.YAMLParser',
+    )
+}
+
+This module provides the `api_setting` object, that is used to access
+REST framework settings, checking for user settings first, then falling
+back to the defaults.
+"""
+from django.conf import settings
+from django.utils import importlib
+
+
+DEFAULTS = {
+    'DEFAULT_RENDERERS': (
+        'rest_framework.renderers.JSONRenderer',
+        'rest_framework.renderers.JSONPRenderer',
+        'rest_framework.renderers.DocumentingHTMLRenderer',
+        'rest_framework.renderers.DocumentingPlainTextRenderer',
+    ),
+    'DEFAULT_PARSERS': (
+        'rest_framework.parsers.JSONParser',
+        'rest_framework.parsers.FormParser'
+    ),
+    'DEFAULT_AUTHENTICATION': (
+        'rest_framework.authentication.SessionAuthentication',
+        'rest_framework.authentication.UserBasicAuthentication'
+    ),
+    'DEFAULT_PERMISSIONS': (),
+    'DEFAULT_THROTTLES': (),
+    'DEFAULT_CONTENT_NEGOTIATION': 'rest_framework.negotiation.DefaultContentNegotiation',
+
+    'UNAUTHENTICATED_USER': 'django.contrib.auth.models.AnonymousUser',
+    'UNAUTHENTICATED_TOKEN': None,
+
+    'FORM_METHOD_OVERRIDE': '_method',
+    'FORM_CONTENT_OVERRIDE': '_content',
+    'FORM_CONTENTTYPE_OVERRIDE': '_content_type',
+    'URL_ACCEPT_OVERRIDE': '_accept',
+    'URL_FORMAT_OVERRIDE': 'format',
+
+    'FORMAT_SUFFIX_KWARG': 'format'
+}
+
+
+# List of settings that may be in string import notation.
+IMPORT_STRINGS = (
+    'DEFAULT_RENDERERS',
+    'DEFAULT_PARSERS',
+    'DEFAULT_AUTHENTICATION',
+    'DEFAULT_PERMISSIONS',
+    'DEFAULT_THROTTLES',
+    'DEFAULT_CONTENT_NEGOTIATION',
+    'UNAUTHENTICATED_USER',
+    'UNAUTHENTICATED_TOKEN',
+)
+
+
+def perform_import(val, setting):
+    """
+    If the given setting is a string import notation,
+    then perform the necessary import or imports.
+    """
+    if val is None or not setting in IMPORT_STRINGS:
+        return val
+
+    if isinstance(val, basestring):
+        return import_from_string(val, setting)
+    elif isinstance(val, (list, tuple)):
+        return [import_from_string(item, setting) for item in val]
+    return val
+
+
+def import_from_string(val, setting):
+    """
+    Attempt to import a class from a string representation.
+    """
+    try:
+        # Nod to tastypie's use of importlib.
+        parts = val.split('.')
+        module_path, class_name = '.'.join(parts[:-1]), parts[-1]
+        module = importlib.import_module(module_path)
+        return getattr(module, class_name)
+    except:
+        msg = "Could not import '%s' for API setting '%s'" % (val, setting)
+        raise ImportError(msg)
+
+
+class APISettings(object):
+    """
+    A settings object, that allows API settings to be accessed as properties.
+    For example:
+
+        from rest_framework.settings import api_settings
+        print api_settings.DEFAULT_RENDERERS
+
+    Any setting with string import paths will be automatically resolved
+    and return the class, rather than the string literal.
+    """
+    def __getattr__(self, attr):
+        if attr not in DEFAULTS.keys():
+            raise AttributeError("Invalid API setting: '%s'" % attr)
+
+        try:
+            # Check if present in user settings
+            val = perform_import(settings.REST_FRAMEWORK[attr], attr)
+        except (AttributeError, KeyError):
+            # Fall back to defaults
+            val = perform_import(DEFAULTS[attr], attr)
+
+        # Cache the result
+        setattr(self, attr, val)
+        return val
+
+api_settings = APISettings()

rest_framework/static/djangorestframework/css/bootstrap-tweaks.css

+/*
+
+This CSS file contains some tweaks specific to the included Bootstrap theme. 
+It's separate from `style.css` so that it can be easily overridden by replacing
+a single block in the template.
+
+*/
+
+
+.form-actions {
+    background: transparent;
+    border-top-color: transparent;
+    padding-top: 0;
+}
+
+.navbar-inverse .brand a {
+    color: #999;
+}
+.navbar-inverse .brand:hover a {
+    color: white;
+    text-decoration: none;
+}
\ No newline at end of file

rest_framework/static/djangorestframework/css/prettify.css

+.com { color: #93a1a1; }
+.lit { color: #195f91; }
+.pun, .opn, .clo { color: #93a1a1; }
+.fun { color: #dc322f; }
+.str, .atv { color: #D14; }
+.kwd, .prettyprint .tag { color: #1e347b; }
+.typ, .atn, .dec, .var { color: teal; }
+.pln { color: #48484c; }
+
+.prettyprint {
+  padding: 8px;
+  background-color: #f7f7f9;
+  border: 1px solid #e1e1e8;
+}
+.prettyprint.linenums {
+  -webkit-box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
+     -moz-box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
+          box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
+}
+
+/* Specify class=linenums on a pre to get line numbering */
+ol.linenums {
+  margin: 0 0 0 33px; /* IE indents via margin-left */
+}
+ol.linenums li {
+  padding-left: 12px;
+  color: #bebec5;
+  line-height: 20px;
+  text-shadow: 0 1px 0 #fff;
+}
\ No newline at end of file

rest_framework/static/djangorestframework/css/style.css

+body {
+    padding-top: 0;
+    padding-bottom: 1em;
+}
+
+/* The navbar is fixed at >= 980px wide, so add padding to the body to prevent
+content running up underneath it. */
+@media (min-width:980px) {
+    body {
+        padding-top: 60px;
+    }
+}
+
+h1 {
+    font-weight: 500;
+}
+
+h2, h3 {
+    font-weight: 300;
+}
+
+.resource-description, .response-info {
+    margin-bottom: 2em;
+}
+
+#footer {
+    border-top: 1px solid #eee;
+    margin-top: 2em;
+    padding-top: 1em;
+    text-align: right;
+}
+
+.version:before {
+    content: "v";
+    opacity: 0.6;
+    padding-right: 0.25em;
+}
+
+.format-option {
+    font-family: Menlo, Consolas, "Andale Mono", "Lucida Console", monospace;
+}
+
+#options-form {
+    position: relative;
+}
+
+/* To allow tooltips to work on disabled elements */
+.disabled-tooltip-shield {
+    position: absolute;
+    top: 0;
+    right: 0;
+    bottom: 0;
+    left: 0;
+}
+
+#options-form {
+    margin-right: 1em;
+}
+
+.errorlist {
+    margin-top: 0.5em;
+}
+
+pre {
+  overflow: auto;
+  word-wrap: normal;
+  white-space: pre;
+  font-size: 12px;
+}
+
+.page-header {
+    border-bottom: none;
+    padding-bottom: 0px;
+}
\ No newline at end of file

rest_framework/static/rest_framework/css/bootstrap-tweaks.css

+/*
+
+This CSS file contains some tweaks specific to the included Bootstrap theme. 
+It's separate from `style.css` so that it can be easily overridden by replacing
+a single block in the template.
+
+*/
+
+
+.form-actions {
+    background: transparent;
+    border-top-color: transparent;
+    padding-top: 0;
+}
+
+.navbar-inverse .brand a {
+    color: #999;
+}
+.navbar-inverse .brand:hover a {
+    color: white;
+    text-decoration: none;
+}
\ No newline at end of file

rest_framework/static/rest_framework/css/prettify.css

+.com { color: #93a1a1; }
+.lit { color: #195f91; }
+.pun, .opn, .clo { color: #93a1a1; }
+.fun { color: #dc322f; }
+.str, .atv { color: #D14; }
+.kwd, .prettyprint .tag { color: #1e347b; }
+.typ, .atn, .dec, .var { color: teal; }
+.pln { color: #48484c; }
+
+.prettyprint {
+  padding: 8px;
+  background-color: #f7f7f9;
+  border: 1px solid #e1e1e8;
+}
+.prettyprint.linenums {
+  -webkit-box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
+     -moz-box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
+          box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
+}
+
+/* Specify class=linenums on a pre to get line numbering */
+ol.linenums {
+  margin: 0 0 0 33px; /* IE indents via margin-left */
+}
+ol.linenums li {
+  padding-left: 12px;
+  color: #bebec5;
+  line-height: 20px;
+  text-shadow: 0 1px 0 #fff;
+}
\ No newline at end of file

rest_framework/static/rest_framework/css/style.css

+body {
+    padding-top: 0;
+    padding-bottom: 1em;
+}
+
+/* The navbar is fixed at >= 980px wide, so add padding to the body to prevent
+content running up underneath it. */
+@media (min-width:980px) {
+    body {
+        padding-top: 60px;
+    }
+}
+
+h1 {
+    font-weight: 500;
+}
+
+h2, h3 {
+    font-weight: 300;
+}
+
+.resource-description, .response-info {
+    margin-bottom: 2em;
+}
+
+#footer {
+    border-top: 1px solid #eee;
+    margin-top: 2em;
+    padding-top: 1em;
+    text-align: right;
+}
+
+.version:before {
+    content: "v";
+    opacity: 0.6;
+    padding-right: 0.25em;
+}
+
+.format-option {
+    font-family: Menlo, Consolas, "Andale Mono", "Lucida Console", monospace;
+}
+
+#options-form {
+    position: relative;
+}
+
+/* To allow tooltips to work on disabled elements */
+.disabled-tooltip-shield {
+    position: absolute;
+    top: 0;
+    right: 0;
+    bottom: 0;
+    left: 0;
+}
+
+#options-form {
+    margin-right: 1em;
+}
+
+.errorlist {
+    margin-top: 0.5em;
+}
+
+pre {
+  overflow: auto;
+  word-wrap: normal;
+  white-space: pre;
+  font-size: 12px;
+}
+
+.page-header {
+    border-bottom: none;
+    padding-bottom: 0px;
+}
\ No newline at end of file

rest_framework/status.py

+"""
+Descriptive HTTP status codes, for code readability.
+
+See RFC 2616 - http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
+And RFC 6585 - http://tools.ietf.org/html/rfc6585
+"""
+
+HTTP_100_CONTINUE = 100
+HTTP_101_SWITCHING_PROTOCOLS = 101
+HTTP_200_OK = 200
+HTTP_201_CREATED = 201
+HTTP_202_ACCEPTED = 202
+HTTP_203_NON_AUTHORITATIVE_INFORMATION = 203
+HTTP_204_NO_CONTENT = 204
+HTTP_205_RESET_CONTENT = 205
+HTTP_206_PARTIAL_CONTENT = 206
+HTTP_300_MULTIPLE_CHOICES = 300
+HTTP_301_MOVED_PERMANENTLY = 301
+HTTP_302_FOUND = 302
+HTTP_303_SEE_OTHER = 303
+HTTP_304_NOT_MODIFIED = 304
+HTTP_305_USE_PROXY = 305
+HTTP_306_RESERVED = 306
+HTTP_307_TEMPORARY_REDIRECT = 307
+HTTP_400_BAD_REQUEST = 400
+HTTP_401_UNAUTHORIZED = 401
+HTTP_402_PAYMENT_REQUIRED = 402
+HTTP_403_FORBIDDEN = 403
+HTTP_404_NOT_FOUND = 404
+HTTP_405_METHOD_NOT_ALLOWED = 405
+HTTP_406_NOT_ACCEPTABLE = 406
+HTTP_407_PROXY_AUTHENTICATION_REQUIRED = 407
+HTTP_408_REQUEST_TIMEOUT = 408
+HTTP_409_CONFLICT = 409
+HTTP_410_GONE = 410
+HTTP_411_LENGTH_REQUIRED = 411
+HTTP_412_PRECONDITION_FAILED = 412
+HTTP_413_REQUEST_ENTITY_TOO_LARGE = 413
+HTTP_414_REQUEST_URI_TOO_LONG = 414
+HTTP_415_UNSUPPORTED_MEDIA_TYPE = 415
+HTTP_416_REQUESTED_RANGE_NOT_SATISFIABLE = 416
+HTTP_417_EXPECTATION_FAILED = 417
+HTTP_428_PRECONDITION_REQUIRED = 428
+HTTP_429_TOO_MANY_REQUESTS = 429
+HTTP_431_REQUEST_HEADER_FIELDS_TOO_LARGE = 431
+HTTP_500_INTERNAL_SERVER_ERROR = 500
+HTTP_501_NOT_IMPLEMENTED = 501
+HTTP_502_BAD_GATEWAY = 502
+HTTP_503_SERVICE_UNAVAILABLE = 503
+HTTP_504_GATEWAY_TIMEOUT = 504
+HTTP_505_HTTP_VERSION_NOT_SUPPORTED = 505
+HTTP_511_NETWORD_AUTHENTICATION_REQUIRED = 511

rest_framework/templates/rest_framework/api.html

+{% extends "rest_framework/base.html" %}
+
+{# Override this template in your own templates directory to customize #}

rest_framework/templates/rest_framework/api.txt

+{% autoescape off %}{{ name }}
+
+{{ description }}
+
+HTTP {{ response.status_code }} {{ response.status_text }}
+{% for key, val in response.headers.items %}{{ key }}: {{ val }}
+{% endfor %}
+{{ content }}{% endautoescape %}

rest_framework/templates/rest_framework/login.html

+{% load url from future %}
+{% load static %}
+<html>
+
+    <head>
+        <link rel="stylesheet" type="text/css" href='{% get_static_prefix %}rest_framework/css/style.css'/>
+    </head>
+
+    <body class="login">
+
+        <div id="container">
+
+            <div id="header">
+                <div id="branding">
+                    <h1 id="site-name">Django REST framework</h1>
+                </div>
+            </div>
+
+            <div id="content" class="colM">
+                <div id="content-main">
+                    <form method="post" action="{% url 'rest_framework:login' %}" id="login-form">
+                        {% csrf_token %}
+                        <div class="form-row">
+                            <label for="id_username">Username:</label> {{ form.username }}
+                        </div>
+                        <div class="form-row">
+                            <label for="id_password">Password:</label> {{ form.password }}
+                            <input type="hidden" name="next" value="{{ next }}" />
+                        </div>
+                        <div class="form-row">
+                            <label>&nbsp;</label><input type="submit" value="Log in">
+                        </div>
+                    </form>
+                    <script type="text/javascript">
+                        document.getElementById('id_username').focus()
+                    </script>
+                </div>
+                <br class="clear">
+            </div>
+
+            <div id="footer"></div>
+
+        </div>
+    </body>
+</html>

rest_framework/templatetags/add_class.py

+"""
+From http://stackoverflow.com/questions/4124220/django-adding-css-classes-when-rendering-form-fields-in-a-template
+
+The add_class filter allows for inserting classes into template variables that
+contain HTML tags, useful for modifying forms without needing to change the
+Form objects.
+
+To use:
+
+    {{ field.label_tag|add_class:"control-label" }}
+
+will insert the class `controls-label` into the label tag generated by a form.
+
+In the case of Django REST Framework, the filter is used to add Bootstrap-specific
+classes to the forms, while still allowing non-Bootstrap customization of the
+browsable API.
+"""
+
+import re
+from django.utils.safestring import mark_safe
+from django import template
+
+register = template.Library()
+class_re = re.compile(r'(?<=class=["\'])(.*)(?=["\'])')
+
+@register.filter
+def add_class(value, css_class):
+    string = unicode(value)
+    match = class_re.search(string)
+    if match:
+        m = re.search(r'^%s$|^%s\s|\s%s\s|\s%s$' % (css_class, css_class, 
+                                                    css_class, css_class), 
+                      match.group(1))
+        print match.group(1)
+        if not m:
+            return mark_safe(class_re.sub(match.group(1) + " " + css_class, 
+                                          string))
+    else:
+        return mark_safe(string.replace('>', ' class="%s">' % css_class, 1))
+    return value
\ No newline at end of file

rest_framework/templatetags/add_query_param.py

+from django.http import QueryDict
+from django.template import Library
+from urlparse import urlparse, urlunparse
+register = Library()
+
+
+def replace_query_param(url, key, val):
+    (scheme, netloc, path, params, query, fragment) = urlparse(url)
+    query_dict = QueryDict(query).copy()
+    query_dict[key] = val
+    query = query_dict.urlencode()
+    return urlunparse((scheme, netloc, path, params, query, fragment))
+
+
+def add_query_param(url, param):
+    key, val = param.split('=')
+    return replace_query_param(url, key, val)
+
+
+register.filter('add_query_param', add_query_param)

rest_framework/templatetags/optional_login.py

+"""
+Tags to optionally include the login and logout links, depending on if the
+login and logout views are in the urlconf.
+"""
+from django import template
+from django.core.urlresolvers import reverse, NoReverseMatch
+
+register = template.Library()
+
+
+@register.simple_tag(takes_context=True)
+def optional_login(context):
+    try:
+        login_url = reverse('rest_framework:login')
+    except NoReverseMatch:
+        return ''
+
+    request = context['request']
+    snippet = "<a href='%s?next=%s'>Log in</a>" % (login_url, request.path)
+    return snippet
+
+
+@register.simple_tag(takes_context=True)
+def optional_logout(context):
+    try:
+        logout_url = reverse('rest_framework:logout')
+    except NoReverseMatch:
+        return ''
+
+    request = context['request']
+    snippet = "<a href='%s?next=%s'>Log out</a>" % (logout_url, request.path)
+    return snippet

rest_framework/templatetags/urlize_quoted_links.py

+"""
+Adds the custom filter 'urlize_quoted_links'
+
+This is identical to the built-in filter 'urlize' with the exception that
+single and double quotes are permitted as leading or trailing punctuation.
+
+Almost all of this code is copied verbatim from django.utils.html
+LEADING_PUNCTUATION and TRAILING_PUNCTUATION have been modified
+"""
+
+import re
+import string
+
+from django.utils.safestring import SafeData, mark_safe
+from django.utils.encoding import force_unicode
+from django.utils.html import escape
+from django import template
+
+# Configuration for urlize() function.
+LEADING_PUNCTUATION = ['(', '<', '&lt;', '"', "'"]
+TRAILING_PUNCTUATION = ['.', ',', ')', '>', '\n', '&gt;', '"', "'"]
+
+# List of possible strings used for bullets in bulleted lists.
+DOTS = ['&middot;', '*', '\xe2\x80\xa2', '&#149;', '&bull;', '&#8226;']
+
+unencoded_ampersands_re = re.compile(r'&(?!(\w+|#\d+);)')
+word_split_re = re.compile(r'(\s+)')
+punctuation_re = re.compile('^(?P<lead>(?:%s)*)(?P<middle>.*?)(?P<trail>(?:%s)*)$' % \
+    ('|'.join([re.escape(x) for x in LEADING_PUNCTUATION]),
+    '|'.join([re.escape(x) for x in TRAILING_PUNCTUATION])))
+simple_email_re = re.compile(r'^\S+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9._-]+$')
+link_target_attribute_re = re.compile(r'(<a [^>]*?)target=[^\s>]+')
+html_gunk_re = re.compile(r'(?:<br clear="all">|<i><\/i>|<b><\/b>|<em><\/em>|<strong><\/strong>|<\/?smallcaps>|<\/?uppercase>)', re.IGNORECASE)
+hard_coded_bullets_re = re.compile(r'((?:<p>(?:%s).*?[a-zA-Z].*?</p>\s*)+)' % '|'.join([re.escape(x) for x in DOTS]), re.DOTALL)
+trailing_empty_content_re = re.compile(r'(?:<p>(?:&nbsp;|\s|<br \/>)*?</p>\s*)+\Z')
+
+
+def urlize_quoted_links(text, trim_url_limit=None, nofollow=True, autoescape=True):
+    """
+    Converts any URLs in text into clickable links.
+
+    Works on http://, https://, www. links and links ending in .org, .net or
+    .com. Links can have trailing punctuation (periods, commas, close-parens)
+    and leading punctuation (opening parens) and it'll still do the right
+    thing.
+
+    If trim_url_limit is not None, the URLs in link text longer than this limit
+    will truncated to trim_url_limit-3 characters and appended with an elipsis.
+
+    If nofollow is True, the URLs in link text will get a rel="nofollow"
+    attribute.
+
+    If autoescape is True, the link text and URLs will get autoescaped.
+    """
+    trim_url = lambda x, limit=trim_url_limit: limit is not None and (len(x) > limit and ('%s...' % x[:max(0, limit - 3)])) or x
+    safe_input = isinstance(text, SafeData)
+    words = word_split_re.split(force_unicode(text))
+    nofollow_attr = nofollow and ' rel="nofollow"' or ''
+    for i, word in enumerate(words):
+        match = None
+        if '.' in word or '@' in word or ':' in word:
+            match = punctuation_re.match(word)
+        if match:
+            lead, middle, trail = match.groups()
+            # Make URL we want to point to.
+            url = None
+            if middle.startswith('http://') or middle.startswith('https://'):
+                url = middle
+            elif middle.startswith('www.') or ('@' not in middle and \
+                    middle and middle[0] in string.ascii_letters + string.digits and \
+                    (middle.endswith('.org') or middle.endswith('.net') or middle.endswith('.com'))):
+                url = 'http://%s' % middle
+            elif '@' in middle and not ':' in middle and simple_email_re.match(middle):
+                url = 'mailto:%s' % middle
+                nofollow_attr = ''
+            # Make link.
+            if url:
+                trimmed = trim_url(middle)
+                if autoescape and not safe_input:
+                    lead, trail = escape(lead), escape(trail)
+                    url, trimmed = escape(url), escape(trimmed)
+                middle = '<a href="%s"%s>%s</a>' % (url, nofollow_attr, trimmed)
+                words[i] = mark_safe('%s%s%s' % (lead, middle, trail))
+            else:
+                if safe_input:
+                    words[i] = mark_safe(word)
+                elif autoescape:
+                    words[i] = escape(word)
+        elif safe_input:
+            words[i] = mark_safe(word)
+        elif autoescape:
+            words[i] = escape(word)
+    return u''.join(words)
+
+
+#urlize_quoted_links.needs_autoescape = True
+urlize_quoted_links.is_safe = True
+
+# Register urlize_quoted_links as a custom filter
+# http://docs.djangoproject.com/en/dev/howto/custom-template-tags/
+register = template.Library()
+register.filter(urlize_quoted_links)

rest_framework/tests/__init__.py

+"""Force import of all modules in this package in order to get the standard test runner to pick up the tests.  Yowzers."""
+import os
+
+modules = [filename.rsplit('.', 1)[0]
+           for filename in os.listdir(os.path.dirname(__file__))
+           if filename.endswith('.py') and not filename.startswith('_')]
+__test__ = dict()
+
+for module in modules:
+    exec("from rest_framework.tests.%s import __doc__ as module_doc" % module)
+    exec("from rest_framework.tests.%s import *" % module)
+    __test__[module] = module_doc or ""

rest_framework/tests/authentication.py

+from django.conf.urls.defaults import patterns
+from django.contrib.auth.models import User
+from django.test import Client, TestCase
+
+from django.utils import simplejson as json
+from django.http import HttpResponse
+
+from rest_framework.views import APIView
+from rest_framework import permissions
+
+from rest_framework.authtoken.models import Token
+from rest_framework.authentication import TokenAuthentication
+
+import base64
+
+
+class MockView(APIView):
+    permission_classes = (permissions.IsAuthenticated,)
+
+    def post(self, request):
+        return HttpResponse({'a': 1, 'b': 2, 'c': 3})
+
+    def put(self, request):
+        return HttpResponse({'a': 1, 'b': 2, 'c': 3})
+
+MockView.authentication_classes += (TokenAuthentication,)
+
+urlpatterns = patterns('',
+    (r'^$', MockView.as_view()),
+)
+
+
+class BasicAuthTests(TestCase):
+    """Basic authentication"""
+    urls = 'rest_framework.tests.authentication'
+
+    def setUp(self):
+        self.csrf_client = Client(enforce_csrf_checks=True)
+        self.username = 'john'
+        self.email = 'lennon@thebeatles.com'
+        self.password = 'password'
+        self.user = User.objects.create_user(self.username, self.email, self.password)
+
+    def test_post_form_passing_basic_auth(self):
+        """Ensure POSTing json over basic auth with correct credentials passes and does not require CSRF"""
+        auth = 'Basic %s' % base64.encodestring('%s:%s' % (self.username, self.password)).strip()
+        response = self.csrf_client.post('/', {'example': 'example'}, HTTP_AUTHORIZATION=auth)
+        self.assertEqual(response.status_code, 200)
+
+    def test_post_json_passing_basic_auth(self):
+        """Ensure POSTing form over basic auth with correct credentials passes and does not require CSRF"""
+        auth = 'Basic %s' % base64.encodestring('%s:%s' % (self.username, self.password)).strip()
+        response = self.csrf_client.post('/', json.dumps({'example': 'example'}), 'application/json', HTTP_AUTHORIZATION=auth)
+        self.assertEqual(response.status_code, 200)
+
+    def test_post_form_failing_basic_auth(self):
+        """Ensure POSTing form over basic auth without correct credentials fails"""
+        response = self.csrf_client.post('/', {'example': 'example'})
+        self.assertEqual(response.status_code, 403)
+
+    def test_post_json_failing_basic_auth(self):
+        """Ensure POSTing json over basic auth without correct credentials fails"""
+        response = self.csrf_client.post('/', json.dumps({'example': 'example'}), 'application/json')
+        self.assertEqual(response.status_code, 403)
+
+
+class SessionAuthTests(TestCase):
+    """User session authentication"""
+    urls = 'rest_framework.tests.authentication'
+
+    def setUp(self):
+        self.csrf_client = Client(enforce_csrf_checks=True)
+        self.non_csrf_client = Client(enforce_csrf_checks=False)
+        self.username = 'john'
+        self.email = 'lennon@thebeatles.com'
+        self.password = 'password'
+        self.user = User.objects.create_user(self.username, self.email, self.password)
+
+    def tearDown(self):
+        self.csrf_client.logout()
+
+    def test_post_form_session_auth_failing_csrf(self):
+        """
+        Ensure POSTing form over session authentication without CSRF token fails.
+        """
+        self.csrf_client.login(username=self.username, password=self.password)
+        response = self.csrf_client.post('/', {'example': 'example'})
+        self.assertEqual(response.status_code, 403)
+
+    def test_post_form_session_auth_passing(self):
+        """
+        Ensure POSTing form over session authentication with logged in user and CSRF token passes.
+        """
+        self.non_csrf_client.login(username=self.username, password=self.password)
+        response = self.non_csrf_client.post('/', {'example': 'example'})
+        self.assertEqual(response.status_code, 200)
+
+    def test_put_form_session_auth_passing(self):
+        """
+        Ensure PUTting form over session authentication with logged in user and CSRF token passes.
+        """
+        self.non_csrf_client.login(username=self.username, password=self.password)
+        response = self.non_csrf_client.put('/', {'example': 'example'})
+        self.assertEqual(response.status_code, 200)
+
+    def test_post_form_session_auth_failing(self):
+        """
+        Ensure POSTing form over session authentication without logged in user fails.
+        """
+        response = self.csrf_client.post('/', {'example': 'example'})
+        self.assertEqual(response.status_code, 403)
+
+
+class TokenAuthTests(TestCase):
+    """Token authentication"""
+    urls = 'rest_framework.tests.authentication'
+
+    def setUp(self):
+        self.csrf_client = Client(enforce_csrf_checks=True)
+        self.username = 'john'
+        self.email = 'lennon@thebeatles.com'
+        self.password = 'password'
+        self.user = User.objects.create_user(self.username, self.email, self.password)
+
+        self.key = 'abcd1234'
+        self.token = Token.objects.create(key=self.key, user=self.user)
+
+    def test_post_form_passing_token_auth(self):
+        """Ensure POSTing json over token auth with correct credentials passes and does not require CSRF"""
+        auth = "Token " + self.key
+        response = self.csrf_client.post('/', {'example': 'example'}, HTTP_AUTHORIZATION=auth)
+        self.assertEqual(response.status_code, 200)
+
+    def test_post_json_passing_token_auth(self):
+        """Ensure POSTing form over token auth with correct credentials passes and does not require CSRF"""
+        auth = "Token " + self.key
+        response = self.csrf_client.post('/', json.dumps({'example': 'example'}), 'application/json', HTTP_AUTHORIZATION=auth)
+        self.assertEqual(response.status_code, 200)
+
+    def test_post_form_failing_token_auth(self):
+        """Ensure POSTing form over token auth without correct credentials fails"""
+        response = self.csrf_client.post('/', {'example': 'example'})
+        self.assertEqual(response.status_code, 403)
+
+    def test_post_json_failing_token_auth(self):
+        """Ensure POSTing json over token auth without correct credentials fails"""
+        response = self.csrf_client.post('/', json.dumps({'example': 'example'}), 'application/json')
+        self.assertEqual(response.status_code, 403)
+
+    def test_token_has_auto_assigned_key_if_none_provided(self):
+        """Ensure creating a token with no key will auto-assign a key"""
+        token = Token.objects.create(user=self.user)
+        self.assertTrue(bool(token.key))

rest_framework/tests/breadcrumbs.py

+from django.conf.urls.defaults import patterns, url
+from django.test import TestCase
+from rest_framework.utils.breadcrumbs import get_breadcrumbs
+from rest_framework.views import APIView
+
+
+class Root(APIView):
+    pass
+
+
+class ResourceRoot(APIView):
+    pass
+
+
+class ResourceInstance(APIView):
+    pass
+
+
+class NestedResourceRoot(APIView):
+    pass
+
+
+class NestedResourceInstance(APIView):
+    pass
+
+urlpatterns = patterns('',
+    url(r'^$', Root.as_view()),
+    url(r'^resource/$', ResourceRoot.as_view()),
+    url(r'^resource/(?P<key>[0-9]+)$', ResourceInstance.as_view()),
+    url(r'^resource/(?P<key>[0-9]+)/$', NestedResourceRoot.as_view()),
+    url(r'^resource/(?P<key>[0-9]+)/(?P<other>[A-Za-z]+)$', NestedResourceInstance.as_view()),
+)
+
+
+class BreadcrumbTests(TestCase):
+    """Tests the breadcrumb functionality used by the HTML renderer."""
+
+    urls = 'rest_framework.tests.breadcrumbs'
+
+    def test_root_breadcrumbs(self):
+        url = '/'
+        self.assertEqual(get_breadcrumbs(url), [('Root', '/')])
+
+    def test_resource_root_breadcrumbs(self):
+        url = '/resource/'
+        self.assertEqual(get_breadcrumbs(url), [('Root', '/'),
+                                            ('Resource Root', '/resource/')])
+
+    def test_resource_instance_breadcrumbs(self):
+        url = '/resource/123'
+        self.assertEqual(get_breadcrumbs(url), [('Root', '/'),
+                                            ('Resource Root', '/resource/'),
+                                            ('Resource Instance', '/resource/123')])
+
+    def test_nested_resource_breadcrumbs(self):
+        url = '/resource/123/'
+        self.assertEqual(get_breadcrumbs(url), [('Root', '/'),
+                                            ('Resource Root', '/resource/'),
+                                            ('Resource Instance', '/resource/123'),
+                                            ('Nested Resource Root', '/resource/123/')])
+
+    def test_nested_resource_instance_breadcrumbs(self):
+        url = '/resource/123/abc'
+        self.assertEqual(get_breadcrumbs(url), [('Root', '/'),
+                                            ('Resource Root', '/resource/'),
+                                            ('Resource Instance', '/resource/123'),
+                                            ('Nested Resource Root', '/resource/123/'),
+                                            ('Nested Resource Instance', '/resource/123/abc')])
+
+    def test_broken_url_breadcrumbs_handled_gracefully(self):
+        url = '/foobar'
+        self.assertEqual(get_breadcrumbs(url), [('Root', '/')])

rest_framework/tests/description.py

+from django.test import TestCase
+from rest_framework.views import APIView
+from rest_framework.compat import apply_markdown
+
+# We check that docstrings get nicely un-indented.
+DESCRIPTION = """an example docstring
+====================
+
+* list
+* list
+
+another header
+--------------
+
+    code block
+
+indented
+
+# hash style header #"""
+
+# If markdown is installed we also test it's working
+# (and that our wrapped forces '=' to h2 and '-' to h3)
+
+# We support markdown < 2.1 and markdown >= 2.1
+MARKED_DOWN_lt_21 = """<h2>an example docstring</h2>
+<ul>
+<li>list</li>
+<li>list</li>
+</ul>
+<h3>another header</h3>
+<pre><code>code block
+</code></pre>
+<p>indented</p>
+<h2 id="hash_style_header">hash style header</h2>"""
+
+MARKED_DOWN_gte_21 = """<h2 id="an-example-docstring">an example docstring</h2>
+<ul>
+<li>list</li>
+<li>list</li>
+</ul>
+<h3 id="another-header">another header</h3>
+<pre><code>code block
+</code></pre>
+<p>indented</p>
+<h2 id="hash-style-header">hash style header</h2>"""
+
+
+class TestViewNamesAndDescriptions(TestCase):
+    def test_resource_name_uses_classname_by_default(self):
+        """Ensure Resource names are based on the classname by default."""
+        class MockView(APIView):
+            pass
+        self.assertEquals(MockView().get_name(), 'Mock')
+
+    def test_resource_name_can_be_set_explicitly(self):
+        """Ensure Resource names can be set using the 'get_name' method."""
+        example = 'Some Other Name'
+        class MockView(APIView):
+            def get_name(self):
+                return example
+        self.assertEquals(MockView().get_name(), example)
+
+    def test_resource_description_uses_docstring_by_default(self):
+        """Ensure Resource names are based on the docstring by default."""
+        class MockView(APIView):
+            """an example docstring
+            ====================
+
+            * list
+            * list
+
+            another header
+            --------------
+
+                code block
+
+            indented
+
+            # hash style header #"""
+
+        self.assertEquals(MockView().get_description(), DESCRIPTION)
+
+    def test_resource_description_can_be_set_explicitly(self):
+        """Ensure Resource descriptions can be set using the 'get_description' method."""
+        example = 'Some other description'
+
+        class MockView(APIView):
+            """docstring"""
+            def get_description(self):
+                return example
+        self.assertEquals(MockView().get_description(), example)
+
+    def test_resource_description_does_not_require_docstring(self):
+        """Ensure that empty docstrings do not affect the Resource's description if it has been set using the 'get_description' method."""
+        example = 'Some other description'
+
+        class MockView(APIView):
+            def get_description(self):
+                return example
+        self.assertEquals(MockView().get_description(), example)
+
+    def test_resource_description_can_be_empty(self):
+        """Ensure that if a resource has no doctring or 'description' class attribute, then it's description is the empty string."""
+        class MockView(APIView):
+            pass
+        self.assertEquals(MockView().get_description(), '')
+
+    def test_markdown(self):
+        """Ensure markdown to HTML works as expected"""
+        if apply_markdown:
+            gte_21_match = apply_markdown(DESCRIPTION) == MARKED_DOWN_gte_21
+            lt_21_match = apply_markdown(DESCRIPTION) == MARKED_DOWN_lt_21
+            self.assertTrue(gte_21_match or lt_21_match)

rest_framework/tests/files.py

+# from django.test import TestCase
+# from django import forms
+
+# from rest_framework.compat import RequestFactory
+# from rest_framework.views import View
+# from rest_framework.response import Response
+
+# import StringIO
+
+
+# class UploadFilesTests(TestCase):
+#     """Check uploading of files"""
+#     def setUp(self):
+#         self.factory = RequestFactory()
+
+#     def test_upload_file(self):
+
+#         class FileForm(forms.Form):
+#             file = forms.FileField()
+
+#         class MockView(View):
+#             permissions = ()
+#             form = FileForm
+
+#             def post(self, request, *args, **kwargs):
+#                 return Response({'FILE_NAME': self.CONTENT['file'].name,
+#                         'FILE_CONTENT': self.CONTENT['file'].read()})
+
+#         file = StringIO.StringIO('stuff')
+#         file.name = 'stuff.txt'
+#         request = self.factory.post('/', {'file': file})
+#         view = MockView.as_view()
+#         response = view(request)
+#         self.assertEquals(response.raw_content, {"FILE_CONTENT": "stuff", "FILE_NAME": "stuff.txt"})

rest_framework/tests/models.py

+from django.db import models
+from django.contrib.auth.models import Group
+
+class CustomUser(models.Model):
+    """
+    A custom user model, which uses a 'through' table for the foreign key
+    """
+    username = models.CharField(max_length=255, unique=True)
+    groups = models.ManyToManyField(
+        to=Group, blank=True, null=True, through='UserGroupMap'
+    )
+
+    @models.permalink
+    def get_absolute_url(self):
+        return ('custom_user', (), {
+            'pk': self.id
+    })
+
+
+class UserGroupMap(models.Model):
+    user = models.ForeignKey(to=CustomUser)
+    group = models.ForeignKey(to=Group)      
+    
+    @models.permalink
+    def get_absolute_url(self):
+        return ('user_group_map', (), {
+            'pk': self.id
+        })

rest_framework/tests/modelviews.py

+# from django.conf.urls.defaults import patterns, url
+# from django.forms import ModelForm
+# from django.contrib.auth.models import Group, User
+# from rest_framework.resources import ModelResource
+# from rest_framework.views import ListOrCreateModelView, InstanceModelView
+# from rest_framework.tests.models import CustomUser
+# from rest_framework.tests.testcases import TestModelsTestCase
+
+
+# class GroupResource(ModelResource):
+#     model = Group
+
+
+# class UserForm(ModelForm):
+#     class Meta:
+#         model = User
+#         exclude = ('last_login', 'date_joined')
+
+
+# class UserResource(ModelResource):
+#     model = User
+#     form = UserForm
+
+
+# class CustomUserResource(ModelResource):
+#     model = CustomUser
+
+# urlpatterns = patterns('',
+#     url(r'^users/$', ListOrCreateModelView.as_view(resource=UserResource), name='users'),
+#     url(r'^users/(?P<id>[0-9]+)/$', InstanceModelView.as_view(resource=UserResource)),
+#     url(r'^customusers/$', ListOrCreateModelView.as_view(resource=CustomUserResource), name='customusers'),
+#     url(r'^customusers/(?P<id>[0-9]+)/$', InstanceModelView.as_view(resource=CustomUserResource)),
+#     url(r'^groups/$', ListOrCreateModelView.as_view(resource=GroupResource), name='groups'),
+#     url(r'^groups/(?P<id>[0-9]+)/$', InstanceModelView.as_view(resource=GroupResource)),
+# )
+
+
+# class ModelViewTests(TestModelsTestCase):
+#     """Test the model views rest_framework provides"""
+#     urls = 'rest_framework.tests.modelviews'
+
+#     def test_creation(self):
+#         """Ensure that a model object can be created"""
+#         self.assertEqual(0, Group.objects.count())
+
+#         response = self.client.post('/groups/', {'name': 'foo'})
+
+#         self.assertEqual(response.status_code, 201)
+#         self.assertEqual(1, Group.objects.count())
+#         self.assertEqual('foo', Group.objects.all()[0].name)
+
+#     def test_creation_with_m2m_relation(self):
+#         """Ensure that a model object with a m2m relation can be created"""
+#         group = Group(name='foo')
+#         group.save()
+#         self.assertEqual(0, User.objects.count())
+
+#         response = self.client.post('/users/', {'username': 'bar', 'password': 'baz', 'groups': [group.id]})
+
+#         self.assertEqual(response.status_code, 201)
+#         self.assertEqual(1, User.objects.count())
+
+#         user = User.objects.all()[0]
+#         self.assertEqual('bar', user.username)
+#         self.assertEqual('baz', user.password)
+#         self.assertEqual(1, user.groups.count())
+
+#         group = user.groups.all()[0]
+#         self.assertEqual('foo', group.name)
+
+#     def test_creation_with_m2m_relation_through(self):
+#         """
+#         Ensure that a model object with a m2m relation can be created where that
+#         relation uses a through table
+#         """
+#         group = Group(name='foo')
+#         group.save()
+#         self.assertEqual(0, User.objects.count())
+
+#         response = self.client.post('/customusers/', {'username': 'bar', 'groups': [group.id]})
+
+#         self.assertEqual(response.status_code, 201)
+#         self.assertEqual(1, CustomUser.objects.count())
+
+#         user = CustomUser.objects.all()[0]
+#         self.assertEqual('bar', user.username)
+#         self.assertEqual(1, user.groups.count())
+
+#         group = user.groups.all()[0]
+#         self.assertEqual('foo', group.name)

rest_framework/tests/package.py

+"""Tests for the rest_framework package setup."""
+from django.test import TestCase
+import rest_framework
+
+class TestVersion(TestCase):
+    """Simple sanity test to check the VERSION exists"""
+
+    def test_version(self):
+        """Ensure the VERSION exists."""
+        rest_framework.VERSION
+

rest_framework/tests/parsers.py

+# """
+# ..
+#     >>> from rest_framework.parsers import FormParser
+#     >>> from rest_framework.compat import RequestFactory
+#     >>> from rest_framework.views import View
+#     >>> from StringIO import StringIO
+#     >>> from urllib import urlencode
+#     >>> req = RequestFactory().get('/')
+#     >>> some_view = View()
+#     >>> some_view.request = req  # Make as if this request had been dispatched
+#
+# FormParser
+# ============
+#
+# Data flatening
+# ----------------
+#
+# Here is some example data, which would eventually be sent along with a post request :
+#
+#     >>> inpt = urlencode([
+#     ...     ('key1', 'bla1'),
+#     ...     ('key2', 'blo1'), ('key2', 'blo2'),
+#     ... ])
+#
+# Default behaviour for :class:`parsers.FormParser`, is to return a single value for each parameter :
+#
+#     >>> (data, files) = FormParser(some_view).parse(StringIO(inpt))
+#     >>> data == {'key1': 'bla1', 'key2': 'blo1'}
+#     True
+#
+# However, you can customize this behaviour by subclassing :class:`parsers.FormParser`, and overriding :meth:`parsers.FormParser.is_a_list` :
+#
+#     >>> class MyFormParser(FormParser):
+#     ...
+#     ...     def is_a_list(self, key, val_list):
+#     ...         return len(val_list) > 1
+#
+# This new parser only flattens the lists of parameters that contain a single value.
+#
+#     >>> (data, files) = MyFormParser(some_view).parse(StringIO(inpt))
+#     >>> data == {'key1': 'bla1', 'key2': ['blo1', 'blo2']}
+#     True
+#
+# .. note:: The same functionality is available for :class:`parsers.MultiPartParser`.
+#
+# Submitting an empty list
+# --------------------------
+#
+# When submitting an empty select multiple, like this one ::
+#
+#     <select multiple="multiple" name="key2"></select>
+#
+# The browsers usually strip the parameter completely. A hack to avoid this, and therefore being able to submit an empty select multiple, is to submit a value that tells the server that the list is empty ::
+#
+#     <select multiple="multiple" name="key2"><option value="_empty"></select>
+#
+# :class:`parsers.FormParser` provides the server-side implementation for this hack. Considering the following posted data :
+#
+#     >>> inpt = urlencode([
+#     ...     ('key1', 'blo1'), ('key1', '_empty'),
+#     ...     ('key2', '_empty'),
+#     ... ])
+#
+# :class:`parsers.FormParser` strips the values ``_empty`` from all the lists.
+#
+#     >>> (data, files) = MyFormParser(some_view).parse(StringIO(inpt))
+#     >>> data == {'key1': 'blo1'}
+#     True
+#
+# Oh ... but wait a second, the parameter ``key2`` isn't even supposed to be a list, so the parser just stripped it.
+#
+#     >>> class MyFormParser(FormParser):
+#     ...
+#     ...     def is_a_list(self, key, val_list):
+#     ...         return key == 'key2'
+#     ...
+#     >>> (data, files) = MyFormParser(some_view).parse(StringIO(inpt))
+#     >>> data == {'key1': 'blo1', 'key2': []}
+#     True
+#
+# Better like that. Note that you can configure something else than ``_empty`` for the empty value by setting :attr:`parsers.FormParser.EMPTY_VALUE`.
+# """
+# import httplib, mimetypes
+# from tempfile import TemporaryFile
+# from django.test import TestCase
+# from rest_framework.compat import RequestFactory
+# from rest_framework.parsers import MultiPartParser
+# from rest_framework.views import View
+# from StringIO import StringIO
+#
+# def encode_multipart_formdata(fields, files):
+#     """For testing multipart parser.
+#     fields is a sequence of (name, value) elements for regular form fields.
+#     files is a sequence of (name, filename, value) elements for data to be uploaded as files
+#     Return (content_type, body)."""
+#     BOUNDARY = '----------ThIs_Is_tHe_bouNdaRY_$'
+#     CRLF = '\r\n'
+#     L = []
+#     for (key, value) in fields:
+#         L.append('--' + BOUNDARY)
+#         L.append('Content-Disposition: form-data; name="%s"' % key)
+#         L.append('')
+#         L.append(value)
+#     for (key, filename, value) in files:
+#         L.append('--' + BOUNDARY)
+#         L.append('Content-Disposition: form-data; name="%s"; filename="%s"' % (key, filename))
+#         L.append('Content-Type: %s' % get_content_type(filename))
+#         L.append('')
+#         L.append(value)
+#     L.append('--' + BOUNDARY + '--')
+#     L.append('')
+#     body = CRLF.join(L)
+#     content_type = 'multipart/form-data; boundary=%s' % BOUNDARY
+#     return content_type, body
+#
+# def get_content_type(filename):
+#     return mimetypes.guess_type(filename)[0] or 'application/octet-stream'
+#
+#class TestMultiPartParser(TestCase):
+#    def setUp(self):
+#        self.req = RequestFactory()
+#        self.content_type, self.body = encode_multipart_formdata([('key1', 'val1'), ('key1', 'val2')],
+#        [('file1', 'pic.jpg', 'blablabla'), ('file1', 't.txt', 'blobloblo')])
+#
+#    def test_multipartparser(self):
+#        """Ensure that MultiPartParser can parse multipart/form-data that contains a mix of several files and parameters."""
+#        post_req = RequestFactory().post('/', self.body, content_type=self.content_type)
+#        view = View()
+#        view.request = post_req
+#        (data, files) = MultiPartParser(view).parse(StringIO(self.body))
+#        self.assertEqual(data['key1'], 'val1')
+#        self.assertEqual(files['file1'].read(), 'blablabla')
+
+from StringIO import StringIO
+from django import forms
+from django.test import TestCase
+from rest_framework.parsers import FormParser
+from rest_framework.parsers import XMLParser
+import datetime
+
+
+class Form(forms.Form):
+    field1 = forms.CharField(max_length=3)
+    field2 = forms.CharField()
+
+
+class TestFormParser(TestCase):
+    def setUp(self):
+        self.string = "field1=abc&field2=defghijk"
+
+    def test_parse(self):
+        """ Make sure the `QueryDict` works OK """
+        parser = FormParser()
+
+        stream = StringIO(self.string)
+        data = parser.parse(stream)
+
+        self.assertEqual(Form(data).is_valid(), True)
+
+
+class TestXMLParser(TestCase):
+    def setUp(self):
+        self._input = StringIO(
+            '<?xml version="1.0" encoding="utf-8"?>'
+            '<root>'
+            '<field_a>121.0</field_a>'
+            '<field_b>dasd</field_b>'
+            '<field_c></field_c>'
+            '<field_d>2011-12-25 12:45:00</field_d>'
+            '</root>'
+        )
+        self._data = {
+            'field_a': 121,
+            'field_b': 'dasd',
+            'field_c': None,
+            'field_d': datetime.datetime(2011, 12, 25, 12, 45, 00)
+        }
+        self._complex_data_input = StringIO(
+            '<?xml version="1.0" encoding="utf-8"?>'
+            '<root>'
+            '<creation_date>2011-12-25 12:45:00</creation_date>'
+            '<sub_data_list>'
+            '<list-item><sub_id>1</sub_id><sub_name>first</sub_name></list-item>'
+            '<list-item><sub_id>2</sub_id><sub_name>second</sub_name></list-item>'
+            '</sub_data_list>'
+            '<name>name</name>'
+            '</root>'
+        )
+        self._complex_data = {
+            "creation_date": datetime.datetime(2011, 12, 25, 12, 45, 00),
+            "name": "name",
+            "sub_data_list": [
+                {
+                    "sub_id": 1,
+                    "sub_name": "first"
+                },
+                {
+                    "sub_id": 2,
+                    "sub_name": "second"
+                }
+            ]
+        }
+
+    def test_parse(self):
+        parser = XMLParser()
+        data = parser.parse(self._input)
+        self.assertEqual(data, self._data)
+
+    def test_complex_data_parse(self):
+        parser = XMLParser()
+        data = parser.parse(self._complex_data_input)
+        self.assertEqual(data, self._complex_data)

rest_framework/tests/request.py

+"""
+Tests for content parsing, and form-overloaded content parsing.
+"""
+from django.conf.urls.defaults import patterns
+from django.contrib.auth.models import User
+from django.test import TestCase, Client
+
+from rest_framework import status
+from rest_framework.authentication import SessionAuthentication
+from rest_framework.compat import RequestFactory
+from rest_framework.parsers import (
+    FormParser,
+    MultiPartParser,
+    PlainTextParser,
+)
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+
+factory = RequestFactory()
+
+
+class TestMethodOverloading(TestCase):
+    def test_method(self):
+        """
+        Request methods should be same as underlying request.
+        """
+        request = Request(factory.get('/'))
+        self.assertEqual(request.method, 'GET')
+        request = Request(factory.post('/'))
+        self.assertEqual(request.method, 'POST')
+
+    def test_overloaded_method(self):
+        """
+        POST requests can be overloaded to another method by setting a
+        reserved form field
+        """
+        request = Request(factory.post('/', {Request._METHOD_PARAM: 'DELETE'}))
+        self.assertEqual(request.method, 'DELETE')
+
+
+class TestContentParsing(TestCase):
+    def test_standard_behaviour_determines_no_content_GET(self):
+        """
+        Ensure request.DATA returns None for GET request with no content.
+        """
+        request = Request(factory.get('/'))
+        self.assertEqual(request.DATA, None)
+
+    def test_standard_behaviour_determines_no_content_HEAD(self):
+        """
+        Ensure request.DATA returns None for HEAD request.
+        """
+        request = Request(factory.head('/'))
+        self.assertEqual(request.DATA, None)
+
+    def test_standard_behaviour_determines_form_content_POST(self):
+        """
+        Ensure request.DATA returns content for POST request with form content.
+        """
+        data = {'qwerty': 'uiop'}
+        request = Request(factory.post('/', data))
+        request.parser_classes = (FormParser, MultiPartParser)
+        self.assertEqual(request.DATA.items(), data.items())
+
+    def test_standard_behaviour_determines_non_form_content_POST(self):
+        """
+        Ensure request.DATA returns content for POST request with
+        non-form content.
+        """
+        content = 'qwerty'
+        content_type = 'text/plain'
+        request = Request(factory.post('/', content, content_type=content_type))
+        request.parser_classes = (PlainTextParser,)
+        self.assertEqual(request.DATA, content)
+
+    def test_standard_behaviour_determines_form_content_PUT(self):
+        """
+        Ensure request.DATA returns content for PUT request with form content.
+        """
+        data = {'qwerty': 'uiop'}
+
+        from django import VERSION
+
+        if VERSION >= (1, 5):
+            from django.test.client import MULTIPART_CONTENT, BOUNDARY, encode_multipart
+            request = Request(factory.put('/', encode_multipart(BOUNDARY, data),
+                                  content_type=MULTIPART_CONTENT))
+        else:
+            request = Request(factory.put('/', data))
+
+        request.parser_classes = (FormParser, MultiPartParser)
+        self.assertEqual(request.DATA.items(), data.items())
+
+    def test_standard_behaviour_determines_non_form_content_PUT(self):
+        """
+        Ensure request.DATA returns content for PUT request with
+        non-form content.
+        """
+        content = 'qwerty'
+        content_type = 'text/plain'
+        request = Request(factory.put('/', content, content_type=content_type))
+        request.parser_classes = (PlainTextParser, )
+        self.assertEqual(request.DATA, content)
+
+    def test_overloaded_behaviour_allows_content_tunnelling(self):
+        """
+        Ensure request.DATA returns content for overloaded POST request.
+        """
+        content = 'qwerty'
+        content_type = 'text/plain'
+        data = {
+            Request._CONTENT_PARAM: content,
+            Request._CONTENTTYPE_PARAM: content_type
+        }
+        request = Request(factory.post('/', data))
+        request.parser_classes = (PlainTextParser, )
+        self.assertEqual(request.DATA, content)
+
+    # def test_accessing_post_after_data_form(self):
+    #     """
+    #     Ensures request.POST can be accessed after request.DATA in
+    #     form request.
+    #     """
+    #     data = {'qwerty': 'uiop'}
+    #     request = factory.post('/', data=data)
+    #     self.assertEqual(request.DATA.items(), data.items())
+    #     self.assertEqual(request.POST.items(), data.items())
+
+    # def test_accessing_post_after_data_for_json(self):
+    #     """
+    #     Ensures request.POST can be accessed after request.DATA in
+    #     json request.
+    #     """
+    #     data = {'qwerty': 'uiop'}
+    #     content = json.dumps(data)
+    #     content_type = 'application/json'
+    #     parsers = (JSONParser, )
+
+    #     request = factory.post('/', content, content_type=content_type,
+    #                            parsers=parsers)
+    #     self.assertEqual(request.DATA.items(), data.items())
+    #     self.assertEqual(request.POST.items(), [])
+
+    # def test_accessing_post_after_data_for_overloaded_json(self):
+    #     """
+    #     Ensures request.POST can be accessed after request.DATA in overloaded
+    #     json request.
+    #     """
+    #     data = {'qwerty': 'uiop'}
+    #     content = json.dumps(data)
+    #     content_type = 'application/json'
+    #     parsers = (JSONParser, )
+    #     form_data = {Request._CONTENT_PARAM: content,
+    #                  Request._CONTENTTYPE_PARAM: content_type}
+
+    #     request = factory.post('/', form_data, parsers=parsers)
+    #     self.assertEqual(request.DATA.items(), data.items())
+    #     self.assertEqual(request.POST.items(), form_data.items())
+
+    # def test_accessing_data_after_post_form(self):
+    #     """
+    #     Ensures request.DATA can be accessed after request.POST in
+    #     form request.
+    #     """
+    #     data = {'qwerty': 'uiop'}
+    #     parsers = (FormParser, MultiPartParser)
+    #     request = factory.post('/', data, parsers=parsers)
+
+    #     self.assertEqual(request.POST.items(), data.items())
+    #     self.assertEqual(request.DATA.items(), data.items())
+
+    # def test_accessing_data_after_post_for_json(self):
+    #     """
+    #     Ensures request.DATA can be accessed after request.POST in
+    #     json request.
+    #     """
+    #     data = {'qwerty': 'uiop'}
+    #     content = json.dumps(data)
+    #     content_type = 'application/json'
+    #     parsers = (JSONParser, )
+    #     request = factory.post('/', content, content_type=content_type,
+    #                            parsers=parsers)
+    #     self.assertEqual(request.POST.items(), [])
+    #     self.assertEqual(request.DATA.items(), data.items())
+
+    # def test_accessing_data_after_post_for_overloaded_json(self):
+    #     """
+    #     Ensures request.DATA can be accessed after request.POST in overloaded
+    #     json request
+    #     """
+    #     data = {'qwerty': 'uiop'}
+    #     content = json.dumps(data)
+    #     content_type = 'application/json'
+    #     parsers = (JSONParser, )
+    #     form_data = {Request._CONTENT_PARAM: content,
+    #                  Request._CONTENTTYPE_PARAM: content_type}
+
+    #     request = factory.post('/', form_data, parsers=parsers)
+    #     self.assertEqual(request.POST.items(), form_data.items())
+    #     self.assertEqual(request.DATA.items(), data.items())
+
+
+class MockView(APIView):
+    authentication_classes = (SessionAuthentication,)
+
+    def post(self, request):
+        if request.POST.get('example') is not None:
+            return Response(status=status.HTTP_200_OK)
+
+        return Response(status=status.INTERNAL_SERVER_ERROR)
+
+urlpatterns = patterns('',
+    (r'^$', MockView.as_view()),
+)
+
+
+class TestContentParsingWithAuthentication(TestCase):
+    urls = 'rest_framework.tests.request'
+
+    def setUp(self):
+        self.csrf_client = Client(enforce_csrf_checks=True)
+        self.username = 'john'
+        self.email = 'lennon@thebeatles.com'
+        self.password = 'password'
+        self.user = User.objects.create_user(self.username, self.email, self.password)
+
+    def test_user_logged_in_authentication_has_POST_when_not_logged_in(self):
+        """
+        Ensures request.POST exists after SessionAuthentication when user
+        doesn't log in.
+        """
+        content = {'example': 'example'}
+
+        response = self.client.post('/', content)
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+
+        response = self.csrf_client.post('/', content)
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+
+    # def test_user_logged_in_authentication_has_post_when_logged_in(self):
+    #     """Ensures request.POST exists after UserLoggedInAuthentication when user does log in"""
+    #     self.client.login(username='john', password='password')
+    #     self.csrf_client.login(username='john', password='password')
+    #     content = {'example': 'example'}
+
+    #     response = self.client.post('/', content)
+    #     self.assertEqual(status.OK, response.status_code, "POST data is malformed")
+
+    #     response = self.csrf_client.post('/', content)
+    #     self.assertEqual(status.OK, response.status_code, "POST data is malformed")

rest_framework/tests/response.py

+import unittest
+
+from django.conf.urls.defaults import patterns, url, include
+from django.test import TestCase
+
+from rest_framework.response import Response
+from rest_framework.views import APIView
+from rest_framework import status
+from rest_framework.renderers import (
+    BaseRenderer,
+    JSONRenderer,
+    DocumentingHTMLRenderer
+)
+
+
+class MockPickleRenderer(BaseRenderer):
+    media_type = 'application/pickle'
+
+
+class MockJsonRenderer(BaseRenderer):
+    media_type = 'application/json'
+
+
+DUMMYSTATUS = status.HTTP_200_OK
+DUMMYCONTENT = 'dummycontent'
+
+RENDERER_A_SERIALIZER = lambda x: 'Renderer A: %s' % x
+RENDERER_B_SERIALIZER = lambda x: 'Renderer B: %s' % x
+
+
+class RendererA(BaseRenderer):
+    media_type = 'mock/renderera'
+    format = "formata"
+
+    def render(self, obj=None, media_type=None):
+        return RENDERER_A_SERIALIZER(obj)
+
+
+class RendererB(BaseRenderer):
+    media_type = 'mock/rendererb'
+    format = "formatb"
+
+    def render(self, obj=None, media_type=None):
+        return RENDERER_B_SERIALIZER(obj)
+
+
+class MockView(APIView):
+    renderer_classes = (RendererA, RendererB)
+
+    def get(self, request, **kwargs):
+        return Response(DUMMYCONTENT, status=DUMMYSTATUS)
+
+
+class HTMLView(APIView):
+    renderer_classes = (DocumentingHTMLRenderer, )
+
+    def get(self, request, **kwargs):
+        return Response('text')
+
+
+class HTMLView1(APIView):
+    renderer_classes = (DocumentingHTMLRenderer, JSONRenderer)
+
+    def get(self, request, **kwargs):
+        return Response('text')
+
+
+urlpatterns = patterns('',
+    url(r'^.*\.(?P<format>.+)$', MockView.as_view(renderer_classes=[RendererA, RendererB])),
+    url(r'^$', MockView.as_view(renderer_classes=[RendererA, RendererB])),
+    url(r'^html$', HTMLView.as_view()),
+    url(r'^html1$', HTMLView1.as_view()),
+    url(r'^restframework', include('rest_framework.urls', namespace='rest_framework'))
+)
+
+
+# TODO: Clean tests bellow - remove duplicates with above, better unit testing, ...
+class RendererIntegrationTests(TestCase):
+    """
+    End-to-end testing of renderers using an ResponseMixin on a generic view.
+    """
+
+    urls = 'rest_framework.tests.response'
+
+    def test_default_renderer_serializes_content(self):
+        """If the Accept header is not set the default renderer should serialize the response."""
+        resp = self.client.get('/')
+        self.assertEquals(resp['Content-Type'], RendererA.media_type)
+        self.assertEquals(resp.content, RENDERER_A_SERIALIZER(DUMMYCONTENT))
+        self.assertEquals(resp.status_code, DUMMYSTATUS)
+
+    def test_head_method_serializes_no_content(self):
+        """No response must be included in HEAD requests."""
+        resp = self.client.head('/')
+        self.assertEquals(resp.status_code, DUMMYSTATUS)
+        self.assertEquals(resp['Content-Type'], RendererA.media_type)
+        self.assertEquals(resp.content, '')
+
+    def test_default_renderer_serializes_content_on_accept_any(self):
+        """If the Accept header is set to */* the default renderer should serialize the response."""
+        resp = self.client.get('/', HTTP_ACCEPT='*/*')
+        self.assertEquals(resp['Content-Type'], RendererA.media_type)
+        self.assertEquals(resp.content, RENDERER_A_SERIALIZER(DUMMYCONTENT))
+        self.assertEquals(resp.status_code, DUMMYSTATUS)
+
+    def test_specified_renderer_serializes_content_default_case(self):
+        """If the Accept header is set the specified renderer should serialize the response.
+        (In this case we check that works for the default renderer)"""
+        resp = self.client.get('/', HTTP_ACCEPT=RendererA.media_type)
+        self.assertEquals(resp['Content-Type'], RendererA.media_type)
+        self.assertEquals(resp.content, RENDERER_A_SERIALIZER(DUMMYCONTENT))
+        self.assertEquals(resp.status_code, DUMMYSTATUS)
+
+    def test_specified_renderer_serializes_content_non_default_case(self):
+        """If the Accept header is set the specified renderer should serialize the response.
+        (In this case we check that works for a non-default renderer)"""
+        resp = self.client.get('/', HTTP_ACCEPT=RendererB.media_type)
+        self.assertEquals(resp['Content-Type'], RendererB.media_type)
+        self.assertEquals(resp.content, RENDERER_B_SERIALIZER(DUMMYCONTENT))
+        self.assertEquals(resp.status_code, DUMMYSTATUS)
+
+    def test_specified_renderer_serializes_content_on_accept_query(self):
+        """The '_accept' query string should behave in the same way as the Accept header."""
+        resp = self.client.get('/?_accept=%s' % RendererB.media_type)
+        self.assertEquals(resp['Content-Type'], RendererB.media_type)
+        self.assertEquals(resp.content, RENDERER_B_SERIALIZER(DUMMYCONTENT))
+        self.assertEquals(resp.status_code, DUMMYSTATUS)
+
+    @unittest.skip('can\'t pass because view is a simple Django view and response is an ImmediateResponse')
+    def test_unsatisfiable_accept_header_on_request_returns_406_status(self):
+        """If the Accept header is unsatisfiable we should return a 406 Not Acceptable response."""
+        resp = self.client.get('/', HTTP_ACCEPT='foo/bar')
+        self.assertEquals(resp.status_code, status.HTTP_406_NOT_ACCEPTABLE)
+
+    def test_specified_renderer_serializes_content_on_format_query(self):
+        """If a 'format' query is specified, the renderer with the matching
+        format attribute should serialize the response."""
+        resp = self.client.get('/?format=%s' % RendererB.format)
+        self.assertEquals(resp['Content-Type'], RendererB.media_type)
+        self.assertEquals(resp.content, RENDERER_B_SERIALIZER(DUMMYCONTENT))
+        self.assertEquals(resp.status_code, DUMMYSTATUS)
+
+    def test_specified_renderer_serializes_content_on_format_kwargs(self):
+        """If a 'format' keyword arg is specified, the renderer with the matching
+        format attribute should serialize the response."""
+        resp = self.client.get('/something.formatb')
+        self.assertEquals(resp['Content-Type'], RendererB.media_type)
+        self.assertEquals(resp.content, RENDERER_B_SERIALIZER(DUMMYCONTENT))
+        self.assertEquals(resp.status_code, DUMMYSTATUS)
+
+    def test_specified_renderer_is_used_on_format_query_with_matching_accept(self):
+        """If both a 'format' query and a matching Accept header specified,
+        the renderer with the matching format attribute should serialize the response."""
+        resp = self.client.get('/?format=%s' % RendererB.format,
+                               HTTP_ACCEPT=RendererB.media_type)
+        self.assertEquals(resp['Content-Type'], RendererB.media_type)
+        self.assertEquals(resp.content, RENDERER_B_SERIALIZER(DUMMYCONTENT))
+        self.assertEquals(resp.status_code, DUMMYSTATUS)
+
+
+class Issue122Tests(TestCase):
+    """
+    Tests that covers #122.
+    """
+    urls = 'rest_framework.tests.response'
+
+    def test_only_html_renderer(self):
+        """
+        Test if no infinite recursion occurs.
+        """
+        self.client.get('/html')
+
+    def test_html_renderer_is_first(self):
+        """
+        Test if no infinite recursion occurs.
+        """
+        self.client.get('/html1')

rest_framework/tests/reverse.py

+from django.conf.urls.defaults import patterns, url
+from django.test import TestCase
+from django.utils import simplejson as json
+
+from rest_framework.renderers import JSONRenderer
+from rest_framework.reverse import reverse
+from rest_framework.views import APIView
+from rest_framework.response import Response
+
+
+class MyView(APIView):
+    """
+    Mock resource which simply returns a URL, so that we can ensure
+    that reversed URLs are fully qualified.
+    """
+    renderers = (JSONRenderer, )
+
+    def get(self, request):
+        return Response(reverse('myview', request=request))
+
+
+urlpatterns = patterns('',
+    url(r'^myview$', MyView.as_view(), name='myview'),
+)
+
+
+class ReverseTests(TestCase):
+    """
+    Tests for fully qualifed URLs when using `reverse`.
+    """
+    urls = 'rest_framework.tests.reverse'
+
+    def test_reversed_urls_are_fully_qualified(self):
+        response = self.client.get('/myview')
+        self.assertEqual(json.loads(response.content), 'http://testserver/myview')

rest_framework/tests/serializer.py

+import datetime
+from django.test import TestCase
+from rest_framework import serializers
+
+
+class Comment(object):
+    def __init__(self, email, content, created):
+        self.email = email
+        self.content = content
+        self.created = created or datetime.datetime.now()
+
+    def __eq__(self, other):
+        return all([getattr(self, attr) == getattr(other, attr)
+                    for attr in ('email', 'content', 'created')])
+
+
+class CommentSerializer(serializers.Serializer):
+    email = serializers.EmailField()
+    content = serializers.CharField(max_length=1000)
+    created = serializers.DateTimeField()
+
+    def restore_object(self, data, instance=None):
+        if instance is None:
+            return Comment(**data)
+        for key, val in data.items():
+            setattr(instance, key, val)
+        return instance
+
+
+class BasicTests(TestCase):
+    def setUp(self):
+        self.comment = Comment(
+            'tom@example.com',
+            'Happy new year!',
+            datetime.datetime(2012, 1, 1)
+        )
+        self.data = {
+            'email': 'tom@example.com',
+            'content': 'Happy new year!',
+            'created': datetime.datetime(2012, 1, 1)
+        }
+
+    def test_empty(self):
+        serializer = CommentSerializer()
+        expected = {
+            'email': '',
+            'content': '',
+            'created': None
+        }
+        self.assertEquals(serializer.data, expected)
+
+    def test_serialization(self):
+        serializer = CommentSerializer(instance=self.comment)
+        expected = self.data
+        self.assertEquals(serializer.data, expected)
+
+    def test_deserialization_for_create(self):
+        serializer = CommentSerializer(self.data)
+        expected = self.comment
+        self.assertEquals(serializer.is_valid(), True)
+        self.assertEquals(serializer.object, expected)
+        self.assertFalse(serializer.object is expected)
+
+    def test_deserialization_for_update(self):
+        serializer = CommentSerializer(self.data, instance=self.comment)
+        expected = self.comment
+        self.assertEquals(serializer.is_valid(), True)
+        self.assertEquals(serializer.object, expected)
+        self.assertTrue(serializer.object is expected)
+
+
+class ValidationTests(TestCase):
+    def setUp(self):
+        self.comment = Comment(
+            'tom@example.com',
+            'Happy new year!',
+            datetime.datetime(2012, 1, 1)
+        )
+        self.data = {
+            'email': 'tom@example.com',
+            'content': 'x' * 1001,
+            'created': datetime.datetime(2012, 1, 1)
+        }
+
+    def test_deserialization_for_create(self):
+        serializer = CommentSerializer(self.data)
+        self.assertEquals(serializer.is_valid(), False)
+        self.assertEquals(serializer.errors, {'content': [u'Ensure this value has at most 1000 characters (it has 1001).']})
+
+    def test_deserialization_for_update(self):
+        serializer = CommentSerializer(self.data, instance=self.comment)
+        self.assertEquals(serializer.is_valid(), False)
+        self.assertEquals(serializer.errors, {'content': [u'Ensure this value has at most 1000 characters (it has 1001).']})
+
+
+class MetadataTests(TestCase):
+    # def setUp(self):
+    #     self.comment = Comment(
+    #         'tomchristie',
+    #         'Happy new year!',
+    #         datetime.datetime(2012, 1, 1)
+    #     )
+    #     self.data = {
+    #         'email': 'tomchristie',
+    #         'content': 'Happy new year!',
+    #         'created': datetime.datetime(2012, 1, 1)
+    #     }
+
+    def test_empty(self):
+        serializer = CommentSerializer()
+        expected = {
+            'email': serializers.CharField,
+            'content': serializers.CharField,
+            'created': serializers.DateTimeField
+        }
+        for field_name, field in expected.items():
+            self.assertTrue(isinstance(serializer.data.fields[field_name], field))

rest_framework/tests/status.py

+"""Tests for the status module"""
+from django.test import TestCase
+from rest_framework import status
+
+
+class TestStatus(TestCase):
+    """Simple sanity test to check the status module"""
+
+    def test_status(self):
+        """Ensure the status module is present and correct."""
+        self.assertEquals(200, status.HTTP_200_OK)
+        self.assertEquals(404, status.HTTP_404_NOT_FOUND)

rest_framework/tests/testcases.py

+# http://djangosnippets.org/snippets/1011/
+from django.conf import settings
+from django.core.management import call_command
+from django.db.models import loading
+from django.test import TestCase
+
+NO_SETTING = ('!', None)
+
+class TestSettingsManager(object):
+    """
+    A class which can modify some Django settings temporarily for a
+    test and then revert them to their original values later.
+
+    Automatically handles resyncing the DB if INSTALLED_APPS is
+    modified.
+
+    """
+    def __init__(self):
+        self._original_settings = {}
+
+    def set(self, **kwargs):
+        for k,v in kwargs.iteritems():
+            self._original_settings.setdefault(k, getattr(settings, k,
+                                                          NO_SETTING))
+            setattr(settings, k, v)
+        if 'INSTALLED_APPS' in kwargs:
+            self.syncdb()
+
+    def syncdb(self):
+        loading.cache.loaded = False
+        call_command('syncdb', verbosity=0)
+
+    def revert(self):
+        for k,v in self._original_settings.iteritems():
+            if v == NO_SETTING:
+                delattr(settings, k)
+            else:
+                setattr(settings, k, v)
+        if 'INSTALLED_APPS' in self._original_settings:
+            self.syncdb()
+        self._original_settings = {}
+
+
+class SettingsTestCase(TestCase):
+    """
+    A subclass of the Django TestCase with a settings_manager
+    attribute which is an instance of TestSettingsManager.
+
+    Comes with a tearDown() method that calls
+    self.settings_manager.revert().
+
+    """
+    def __init__(self, *args, **kwargs):
+        super(SettingsTestCase, self).__init__(*args, **kwargs)
+        self.settings_manager = TestSettingsManager()
+
+    def tearDown(self):
+        self.settings_manager.revert()
+
+class TestModelsTestCase(SettingsTestCase):
+    def setUp(self, *args, **kwargs):
+        installed_apps = tuple(settings.INSTALLED_APPS) + ('rest_framework.tests',)
+        self.settings_manager.set(INSTALLED_APPS=installed_apps)

rest_framework/tests/throttling.py

+"""
+Tests for the throttling implementations in the permissions module.
+"""
+
+from django.test import TestCase
+from django.contrib.auth.models import User
+from django.core.cache import cache
+
+from rest_framework.compat import RequestFactory
+from rest_framework.views import APIView
+from rest_framework.throttling import UserRateThrottle
+from rest_framework.response import Response
+
+
+class User3SecRateThrottle(UserRateThrottle):
+    rate = '3/sec'
+    scope = 'seconds'
+
+
+class User3MinRateThrottle(UserRateThrottle):
+    rate = '3/min'
+    scope = 'minutes'
+
+
+class MockView(APIView):
+    throttle_classes = (User3SecRateThrottle,)
+
+    def get(self, request):
+        return Response('foo')
+
+
+class MockView_MinuteThrottling(APIView):
+    throttle_classes = (User3MinRateThrottle,)
+
+    def get(self, request):
+        return Response('foo')
+
+
+class ThrottlingTests(TestCase):
+    urls = 'rest_framework.tests.throttling'
+
+    def setUp(self):
+        """
+        Reset the cache so that no throttles will be active
+        """
+        cache.clear()
+        self.factory = RequestFactory()
+
+    def test_requests_are_throttled(self):
+        """
+        Ensure request rate is limited
+        """
+        request = self.factory.get('/')
+        for dummy in range(4):
+            response = MockView.as_view()(request)
+        self.assertEqual(429, response.status_code)
+
+    def set_throttle_timer(self, view, value):
+        """
+        Explicitly set the timer, overriding time.time()
+        """
+        view.throttle_classes[0].timer = lambda self: value
+
+    def test_request_throttling_expires(self):
+        """
+        Ensure request rate is limited for a limited duration only
+        """
+        self.set_throttle_timer(MockView, 0)
+
+        request = self.factory.get('/')
+        for dummy in range(4):
+            response = MockView.as_view()(request)
+        self.assertEqual(429, response.status_code)
+
+        # Advance the timer by one second
+        self.set_throttle_timer(MockView, 1)
+
+        response = MockView.as_view()(request)
+        self.assertEqual(200, response.status_code)
+
+    def ensure_is_throttled(self, view, expect):
+        request = self.factory.get('/')
+        request.user = User.objects.create(username='a')
+        for dummy in range(3):
+            view.as_view()(request)
+        request.user = User.objects.create(username='b')
+        response = view.as_view()(request)
+        self.assertEqual(expect, response.status_code)
+
+    def test_request_throttling_is_per_user(self):
+        """
+        Ensure request rate is only limited per user, not globally for
+        PerUserThrottles
+        """
+        self.ensure_is_throttled(MockView, 200)
+
+    def ensure_response_header_contains_proper_throttle_field(self, view, expected_headers):
+        """
+        Ensure the response returns an X-Throttle field with status and next attributes
+        set properly.
+        """
+        request = self.factory.get('/')
+        for timer, expect in expected_headers:
+            self.set_throttle_timer(view, timer)
+            response = view.as_view()(request)
+            if expect is not None:
+                self.assertEquals(response['X-Throttle-Wait-Seconds'], expect)
+            else:
+                self.assertFalse('X-Throttle-Wait-Seconds' in response.headers)
+
+    def test_seconds_fields(self):
+        """
+        Ensure for second based throttles.
+        """
+        self.ensure_response_header_contains_proper_throttle_field(MockView,
+         ((0, None),
+          (0, None),
+          (0, None),
+          (0, '1')
+         ))
+
+    def test_minutes_fields(self):
+        """
+        Ensure for minute based throttles.
+        """
+        self.ensure_response_header_contains_proper_throttle_field(MockView_MinuteThrottling,
+         ((0, None),
+          (0, None),
+          (0, None),
+          (0, '60')
+         ))
+
+    def test_next_rate_remains_constant_if_followed(self):
+        """
+        If a client follows the recommended next request rate,
+        the throttling rate should stay constant.
+        """
+        self.ensure_response_header_contains_proper_throttle_field(MockView_MinuteThrottling,
+         ((0, None),
+          (20, None),
+          (40, None),
+          (60, None),
+          (80, None)
+         ))

rest_framework/tests/views.py

+# from django.core.urlresolvers import reverse
+# from django.conf.urls.defaults import patterns, url, include
+# from django.http import HttpResponse
+# from django.test import TestCase
+# from django.utils import simplejson as json
+
+# from rest_framework.views import View
+
+
+# class MockView(View):
+#     """This is a basic mock view"""
+#     pass
+
+
+# class MockViewFinal(View):
+#     """View with final() override"""
+
+#     def final(self, request, response, *args, **kwargs):
+#         return HttpResponse('{"test": "passed"}', content_type="application/json")
+
+
+# # class ResourceMockView(View):
+# #     """This is a resource-based mock view"""
+
+# #     class MockForm(forms.Form):
+# #         foo = forms.BooleanField(required=False)
+# #         bar = forms.IntegerField(help_text='Must be an integer.')
+# #         baz = forms.CharField(max_length=32)
+
+# #     form = MockForm
+
+
+# # class MockResource(ModelResource):
+# #     """This is a mock model-based resource"""
+
+# #     class MockResourceModel(models.Model):
+# #         foo = models.BooleanField()
+# #         bar = models.IntegerField(help_text='Must be an integer.')
+# #         baz = models.CharField(max_length=32, help_text='Free text.  Max length 32 chars.')
+
+# #     model = MockResourceModel
+# #     fields = ('foo', 'bar', 'baz')
+
+# urlpatterns = patterns('',
+#     url(r'^mock/$', MockView.as_view()),
+#     url(r'^mock/final/$', MockViewFinal.as_view()),
+#     # url(r'^resourcemock/$', ResourceMockView.as_view()),
+#     # url(r'^model/$', ListOrCreateModelView.as_view(resource=MockResource)),
+#     # url(r'^model/(?P<pk>[^/]+)/$', InstanceModelView.as_view(resource=MockResource)),
+#     url(r'^restframework/', include('rest_framework.urls', namespace='rest_framework')),
+# )
+
+
+# class BaseViewTests(TestCase):
+#     """Test the base view class of rest_framework"""
+#     urls = 'rest_framework.tests.views'
+
+#     def test_view_call_final(self):
+#         response = self.client.options('/mock/final/')
+#         self.assertEqual(response['Content-Type'].split(';')[0], "application/json")
+#         data = json.loads(response.content)
+#         self.assertEqual(data['test'], 'passed')
+
+#     def test_options_method_simple_view(self):
+#         response = self.client.options('/mock/')
+#         self._verify_options_response(response,
+#                                       name='Mock',
+#                                       description='This is a basic mock view')
+
+#     def test_options_method_resource_view(self):
+#         response = self.client.options('/resourcemock/')
+#         self._verify_options_response(response,
+#                                       name='Resource Mock',
+#                                       description='This is a resource-based mock view',
+#                                       fields={'foo': 'BooleanField',
+#                                               'bar': 'IntegerField',
+#                                               'baz': 'CharField',
+#                                               })
+
+#     def test_options_method_model_resource_list_view(self):
+#         response = self.client.options('/model/')
+#         self._verify_options_response(response,
+#                                       name='Mock List',
+#                                       description='This is a mock model-based resource',
+#                                       fields={'foo': 'BooleanField',
+#                                               'bar': 'IntegerField',
+#                                               'baz': 'CharField',
+#                                               })
+
+#     def test_options_method_model_resource_detail_view(self):
+#         response = self.client.options('/model/0/')
+#         self._verify_options_response(response,
+#                                       name='Mock Instance',
+#                                       description='This is a mock model-based resource',
+#                                       fields={'foo': 'BooleanField',
+#                                               'bar': 'IntegerField',
+#                                               'baz': 'CharField',
+#                                               })
+
+#     def _verify_options_response(self, response, name, description, fields=None, status=200,
+#                                  mime_type='application/json'):
+#         self.assertEqual(response.status_code, status)
+#         self.assertEqual(response['Content-Type'].split(';')[0], mime_type)
+#         data = json.loads(response.content)
+#         self.assertTrue('application/json' in data['renders'])
+#         self.assertEqual(name, data['name'])
+#         self.assertEqual(description, data['description'])
+#         if fields is None:
+#             self.assertFalse(hasattr(data, 'fields'))
+#         else:
+#             self.assertEqual(data['fields'], fields)
+
+
+# class ExtraViewsTests(TestCase):
+#     """Test the extra views rest_framework provides"""
+#     urls = 'rest_framework.tests.views'
+
+#     def test_login_view(self):
+#         """Ensure the login view exists"""
+#         response = self.client.get(reverse('rest_framework:login'))
+#         self.assertEqual(response.status_code, 200)
+#         self.assertEqual(response['Content-Type'].split(';')[0], 'text/html')
+
+#     def test_logout_view(self):
+#         """Ensure the logout view exists"""
+#         response = self.client.get(reverse('rest_framework:logout'))
+#         self.assertEqual(response.status_code, 200)
+#         self.assertEqual(response['Content-Type'].split(';')[0], 'text/html')

rest_framework/throttling.py

+from django.core.cache import cache
+from rest_framework.settings import api_settings
+import time
+
+
+class BaseThrottle(object):
+    """
+    Rate throttling of requests.
+    """
+
+    def __init__(self, view=None):
+        """
+        All throttles hold a reference to the instantiating view.
+        """
+        self.view = view
+
+    def allow_request(self, request):
+        """
+        Return `True` if the request should be allowed, `False` otherwise.
+        """
+        raise NotImplementedError('.allow_request() must be overridden')
+
+    def wait(self):
+        """
+        Optionally, return a recommeded number of seconds to wait before
+        the next request.
+        """
+        return None
+
+
+class SimpleRateThottle(BaseThrottle):
+    """
+    A simple cache implementation, that only requires `.get_cache_key()`
+    to be overridden.
+
+    The rate (requests / seconds) is set by a :attr:`throttle` attribute
+    on the :class:`.View` class.  The attribute is a string of the form 'number of
+    requests/period'.
+
+    Period should be one of: ('s', 'sec', 'm', 'min', 'h', 'hour', 'd', 'day')
+
+    Previous request information used for throttling is stored in the cache.
+    """
+
+    timer = time.time
+    settings = api_settings
+    cache_format = 'throtte_%(scope)s_%(ident)s'
+    scope = None
+
+    def __init__(self, view):
+        super(SimpleRateThottle, self).__init__(view)
+        rate = self.get_rate_description()
+        self.num_requests, self.duration = self.parse_rate_description(rate)
+
+    def get_cache_key(self, request):
+        """
+        Should return a unique cache-key which can be used for throttling.
+        Must be overridden.
+
+        May return `None` if the request should not be throttled.
+        """
+        raise NotImplementedError('.get_cache_key() must be overridden')
+
+    def get_rate_description(self):
+        """
+        Determine the string representation of the allowed request rate.
+        """
+        try:
+            return self.rate
+        except AttributeError:
+            return self.settings.DEFAULT_THROTTLE_RATES.get(self.scope)
+
+    def parse_rate_description(self, rate):
+        """
+        Given the request rate string, return a two tuple of:
+        <allowed number of requests>, <period of time in seconds>
+        """
+        assert rate, "No throttle rate set for '%s'" % self.__class__.__name__
+        num, period = rate.split('/')
+        num_requests = int(num)
+        duration = {'s': 1, 'm': 60, 'h': 3600, 'd': 86400}[period[0]]
+        return (num_requests, duration)
+
+    def allow_request(self, request):
+        """
+        Implement the check to see if the request should be throttled.
+
+        On success calls `throttle_success`.
+        On failure calls `throttle_failure`.
+        """
+        self.key = self.get_cache_key(request)
+        self.history = cache.get(self.key, [])
+        self.now = self.timer()
+
+        # Drop any requests from the history which have now passed the
+        # throttle duration
+        while self.history and self.history[-1] <= self.now - self.duration:
+            self.history.pop()
+        if len(self.history) >= self.num_requests:
+            return self.throttle_failure()
+        return self.throttle_success()
+
+    def throttle_success(self):
+        """
+        Inserts the current request's timestamp along with the key
+        into the cache.
+        """
+        self.history.insert(0, self.now)
+        cache.set(self.key, self.history, self.duration)
+        return True
+
+    def throttle_failure(self):
+        """
+        Called when a request to the API has failed due to throttling.
+        """
+        return False
+
+    def wait(self):
+        """
+        Returns the recommended next request time in seconds.
+        """
+        if self.history:
+            remaining_duration = self.duration - (self.now - self.history[-1])
+        else:
+            remaining_duration = self.duration
+
+        available_requests = self.num_requests - len(self.history) + 1
+
+        return remaining_duration / float(available_requests)
+
+
+class AnonRateThrottle(SimpleRateThottle):
+    """
+    Limits the rate of API calls that may be made by a anonymous users.
+
+    The IP address of the request will be used as the unqiue cache key.
+    """
+    scope = 'anon'
+
+    def get_cache_key(self, request):
+        if request.user.is_authenticated():
+            return None  # Only throttle unauthenticated requests.
+
+        ident = request.META.get('REMOTE_ADDR', None)
+
+        return self.cache_format % {
+            'scope': self.scope,
+            'ident': ident
+        }
+
+
+class UserRateThrottle(SimpleRateThottle):
+    """
+    Limits the rate of API calls that may be made by a given user.
+
+    The user id will be used as a unique cache key if the user is
+    authenticated.  For anonymous requests, the IP address of the request will
+    be used.
+    """
+    scope = 'user'
+
+    def get_cache_key(self, request):
+        if request.user.is_authenticated():
+            ident = request.user.id
+        else:
+            ident = request.META.get('REMOTE_ADDR', None)
+
+        return self.cache_format % {
+            'scope': self.scope,
+            'ident': ident
+        }
+
+
+class ScopedRateThrottle(SimpleRateThottle):
+    """
+    Limits the rate of API calls by different amounts for various parts of
+    the API.  Any view that has the `throttle_scope` property set will be
+    throttled.  The unique cache key will be generated by concatenating the
+    user id of the request, and the scope of the view being accessed.
+    """
+
+    scope_attr = 'throttle_scope'
+
+    def __init__(self, view):
+        """
+        Scope is determined from the view being accessed.
+        """
+        self.scope = getattr(self.view, self.scope_attr, None)
+        super(ScopedRateThrottle, self).__init__(view)
+
+    def parse_rate_description(self, rate):
+        """
+        Subclassed so that we don't fail if `view.throttle_scope` is not set.
+        """
+        if not rate:
+            return (None, None)
+        return super(ScopedRateThrottle, self).parse_rate_description(rate)
+
+    def get_cache_key(self, request):
+        """
+        If `view.throttle_scope` is not set, don't apply this throttle.
+
+        Otherwise generate the unique cache key by concatenating the user id
+        with the '.throttle_scope` property of the view.
+        """
+        if not self.scope:
+            return None  # Only throttle views if `.throttle_scope` is set.
+
+        if request.user.is_authenticated():
+            ident = request.user.id
+        else:
+            ident = request.META.get('REMOTE_ADDR', None)
+
+        return self.cache_format % {
+            'scope': self.scope,
+            'ident': ident
+        }