Create SECURITY.md

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |
+
+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.

api/views.py

@@ -4,164 +4,181 @@
 
 from . import serializers
 from . import models
-from .permissions import IsLinkOwner, IsSubTopicLinkOwner, IsSubTopicOwner, IsTopicOwner, IsCurationOwner
+from .permissions import (
+    IsLinkOwner,
+    IsSubTopicLinkOwner,
+    IsSubTopicOwner,
+    IsTopicOwner,
+    IsCurationOwner,
+)
 
 from rest_framework.decorators import api_view
 from rest_framework.response import Response
 from rest_framework.reverse import reverse
 
 
-@api_view(['GET'])
+@api_view(["GET"])
 def api_root(request, format=None):
-    return Response({
-        'subjects': reverse('subject-list', request=request, format=format),
-        'curations': reverse('curation-list', request=request, format=format)
-    })
-class SubjectList(mixins.ListModelMixin,
-                  generics.GenericAPIView):
+    return Response(
+        {
+            "subjects": reverse("subject-list", request=request, format=format),
+            "curations": reverse("curation-list", request=request, format=format),
+        }
+    )
+
+
+class SubjectList(mixins.ListModelMixin, generics.GenericAPIView):
     queryset = models.Subject.objects.all()
     serializer_class = serializers.SubjectSerializer
 
     def get(self, request, *args, **kwargs):
         return self.list(request, *args, **kwargs)
 
 
-class SubjectDetail(mixins.RetrieveModelMixin,
-                  generics.GenericAPIView):
+class SubjectDetail(mixins.RetrieveModelMixin, generics.GenericAPIView):
     queryset = models.Subject.objects.all()
     serializer_class = serializers.SubjectSerializer
 
     def retrieve(self, request, *args, **kwargs):
         return self.create(request, *args, **kwargs)
 
 
-class CurationList(mixins.ListModelMixin,
-					mixins.CreateModelMixin,
-                	generics.GenericAPIView):
-
-	queryset = models.Curation.objects.all()
-	serializer_class = serializers.CurationSerializer
-	permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsCurationOwner]
+class CurationList(
+    mixins.ListModelMixin, mixins.CreateModelMixin, generics.GenericAPIView
+):
+    queryset = models.Curation.objects.all()
+    serializer_class = serializers.CurationSerializer
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsCurationOwner]
+
+    def get_queryset(self):
+        """
+        Optionally restricts the returned purchases to a given user,
+        by filtering against a `username` query parameter in the URL.
+        """
+        queryset = models.Curation.objects.all()
+        subject = self.request.query_params.get("subject")
+        if subject is not None:
+            queryset = queryset.filter(subject=subject)
+        return queryset
+
+    def post(self, request, *args, **kwargs):
+        return self.create(request, *args, **kwargs)
 
-	def get_queryset(self):
-		"""
-		Optionally restricts the returned purchases to a given user,
-		by filtering against a `username` query parameter in the URL.
-		"""
-		queryset = models.Curation.objects.all()
-		subject = self.request.query_params.get('subject')
-		if subject is not None:
-			queryset = queryset.filter(subject=subject)
-		return queryset
+    def get(self, request, *args, **kwargs):
+        return self.list(request, *args, **kwargs)
 
-	def post(self, request, *args, **kwargs):
-		return self.create(request, *args, **kwargs)
+    def perform_create(self, serializer):
+        serializer.save(owner=self.request.user)
 
-	def get(self, request, *args, **kwargs):
-		return self.list(request, *args, **kwargs)
-
-	def perform_create(self, serializer):
-		serializer.save(owner=self.request.user)
 
+class CurationDetail(
+    mixins.RetrieveModelMixin,
+    mixins.DestroyModelMixin,
+    mixins.UpdateModelMixin,
+    generics.GenericAPIView,
+):
+    queryset = models.Curation.objects.all()
+    serializer_class = serializers.CurationSerializer
 
-class CurationDetail(mixins.RetrieveModelMixin,
-					mixins.DestroyModelMixin,
-					mixins.UpdateModelMixin,
-					generics.GenericAPIView):
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsCurationOwner]
 
-	queryset = models.Curation.objects.all()
-	serializer_class = serializers.CurationSerializer
+    def get(self, request, *args, **kwargs):
+        return self.retrieve(request, *args, **kwargs)
 
-	permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsCurationOwner]
+    def put(self, request, *args, **kwargs):
+        return self.update(request, *args, **kwargs)
 
-	def get(self, request, *args, **kwargs):
-		return self.retrieve(request, *args, **kwargs)
-
-	def put(self, request, *args, **kwargs):
-		return self.update(request, *args, **kwargs)
-
-	def delete(self, request, *args, **kwargs):
-		return super().destroy(request, *args, **kwargs)
+    def delete(self, request, *args, **kwargs):
+        return super().destroy(request, *args, **kwargs)
 
 
 class TopicCreate(mixins.CreateModelMixin, generics.GenericAPIView):
+    queryset = models.Topic.objects.all()
+    serializer_class = serializers.TopicSerializer
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsTopicOwner]
+
+    def post(self, request, *args, **kwargs):
+        return self.create(request, *args, **kwargs)
 
-	queryset = models.Topic.objects.all()
-	serializer_class = serializers.TopicSerializer
-	permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsTopicOwner]
 
-	def post(self, request, *args, **kwargs):
-		return self.create(request, *args, **kwargs)
+class TopicDetail(
+    mixins.DestroyModelMixin, mixins.UpdateModelMixin, generics.GenericAPIView
+):
+    queryset = models.Topic.objects.all()
+    serializer_class = serializers.TopicSerializer
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsTopicOwner]
 
-class TopicDetail(mixins.DestroyModelMixin, mixins.UpdateModelMixin, generics.GenericAPIView):
-	queryset = models.Topic.objects.all()
-	serializer_class = serializers.TopicSerializer
-	permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsTopicOwner]
+    def delete(self, request, *args, **kwargs):
+        return super().destroy(request, *args, **kwargs)
 
-	def delete(self, request, *args, **kwargs):
-		return super().destroy(request, *args, **kwargs)
-
-	def put(self, request, *args, **kwargs):
-		return self.update(request, *args, **kwargs)
+    def put(self, request, *args, **kwargs):
+        return self.update(request, *args, **kwargs)
 
 
 class LinkCreate(mixins.CreateModelMixin, generics.GenericAPIView):
+    queryset = models.Link.objects.all()
+    serializer_class = serializers.LinkSerializer
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsLinkOwner]
+
+    def post(self, request, *args, **kwargs):
+        return self.create(request, *args, **kwargs)
 
-	queryset = models.Link.objects.all()
-	serializer_class = serializers.LinkSerializer
-	permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsLinkOwner]
 
-	def post(self, request, *args, **kwargs):
-		return self.create(request, *args, **kwargs)
+class LinkDetail(
+    mixins.DestroyModelMixin, mixins.UpdateModelMixin, generics.GenericAPIView
+):
+    queryset = models.Link.objects.all()
+    serializer_class = serializers.LinkSerializer
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsLinkOwner]
 
-class LinkDetail(mixins.DestroyModelMixin, mixins.UpdateModelMixin, generics.GenericAPIView):
-	queryset = models.Link.objects.all()
-	serializer_class = serializers.LinkSerializer
-	permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsLinkOwner]
+    def delete(self, request, *args, **kwargs):
+        return super().destroy(request, *args, **kwargs)
+
+    def put(self, request, *args, **kwargs):
+        return self.update(request, *args, **kwargs)
 
-	def delete(self, request, *args, **kwargs):
-		return super().destroy(request, *args, **kwargs)
-
-	def put(self, request, *args, **kwargs):
-		return self.update(request, *args, **kwargs)
 
 class SubTopicCreate(mixins.CreateModelMixin, generics.GenericAPIView):
+    queryset = models.SubTopic.objects.all()
+    serializer_class = serializers.SubTopicSerializer
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsSubTopicOwner]
+
+    def post(self, request, *args, **kwargs):
+        return self.create(request, *args, **kwargs)
+
 
-	queryset = models.SubTopic.objects.all()
-	serializer_class = serializers.SubTopicSerializer
-	permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsSubTopicOwner]
+class SubTopicDetail(
+    mixins.DestroyModelMixin, mixins.UpdateModelMixin, generics.GenericAPIView
+):
+    queryset = models.SubTopic.objects.all()
+    serializer_class = serializers.SubTopicSerializer
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsSubTopicOwner]
 
+    def delete(self, request, *args, **kwargs):
+        return super().destroy(request, *args, **kwargs)
 
-	def post(self, request, *args, **kwargs):
-		return self.create(request, *args, **kwargs)
+    def put(self, request, *args, **kwargs):
+        return self.update(request, *args, **kwargs)
 
-class SubTopicDetail(mixins.DestroyModelMixin, mixins.UpdateModelMixin, generics.GenericAPIView):
-	queryset = models.SubTopic.objects.all()
-	serializer_class = serializers.SubTopicSerializer
-	permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsSubTopicOwner]
 
-	def delete(self, request, *args, **kwargs):
-		return super().destroy(request, *args, **kwargs)
-
-	def put(self, request, *args, **kwargs):
-		return self.update(request, *args, **kwargs)
-
 class SubTopicLinkCreate(mixins.CreateModelMixin, generics.GenericAPIView):
+    queryset = models.SubTopicLink.objects.all()
+    serializer_class = serializers.SubTopicLinkSerializer
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsSubTopicLinkOwner]
+
+    def post(self, request, *args, **kwargs):
+        return self.create(request, *args, **kwargs)
 
-	queryset = models.SubTopicLink.objects.all()
-	serializer_class = serializers.SubTopicLinkSerializer
-	permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsSubTopicLinkOwner]
 
-	def post(self, request, *args, **kwargs):
-		return self.create(request, *args, **kwargs)
+class SubTopicLinkDetail(
+    mixins.DestroyModelMixin, mixins.UpdateModelMixin, generics.GenericAPIView
+):
+    queryset = models.SubTopicLink.objects.all()
+    serializer_class = serializers.SubTopicLinkSerializer
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsSubTopicLinkOwner]
 
-class SubTopicLinkDetail(mixins.DestroyModelMixin, mixins.UpdateModelMixin, generics.GenericAPIView):
-	queryset = models.SubTopicLink.objects.all()
-	serializer_class = serializers.SubTopicLinkSerializer
-	permission_classes = [permissions.IsAuthenticatedOrReadOnly, IsSubTopicLinkOwner]
+    def delete(self, request, *args, **kwargs):
+        return super().destroy(request, *args, **kwargs)
 
-	def delete(self, request, *args, **kwargs):
-		return super().destroy(request, *args, **kwargs)
-
-	def put(self, request, *args, **kwargs):
-		return self.update(request, *args, **kwargs)
+    def put(self, request, *args, **kwargs):
+        return self.update(request, *args, **kwargs)