Use formless default browsable API renderer (#973)

Author: sarayourfriend

api/catalog/api/utils/drf_renderer.py

@@ -0,0 +1,27 @@
+from rest_framework.renderers import BrowsableAPIRenderer
+
+
+class BrowsableAPIRendererWithoutForms(BrowsableAPIRenderer):
+    """
+    Renders the browsable api, but excludes the forms.
+
+    See https://github.com/WordPress/openverse/issues/970
+
+    CC BY 3.0 Brad Montgomery
+    https://bradmontgomery.net/blog/disabling-forms-django-rest-frameworks-browsable-api/
+    """
+
+    def get_context(self, *args, **kwargs):
+        ctx = super().get_context(*args, **kwargs)
+        ctx["display_edit_forms"] = False
+        return ctx
+
+    def show_form_for_method(self, view, method, request, obj):
+        """We never want to do this! So just return False."""
+        return False
+
+    def get_rendered_html_form(self, data, view, method, request):
+        """Why render _any_ forms at all. This method should return
+        rendered HTML, so let's simply return an empty string.
+        """
+        return ""

api/catalog/settings.py

@@ -145,7 +145,7 @@
     "DEFAULT_VERSIONING_CLASS": "rest_framework.versioning.URLPathVersioning",
     "DEFAULT_RENDERER_CLASSES": (
         "rest_framework.renderers.JSONRenderer",
-        "rest_framework.renderers.BrowsableAPIRenderer",
+        "catalog.api.utils.drf_renderer.BrowsableAPIRendererWithoutForms",
         "rest_framework_xml.renderers.XMLRenderer",
     ),
     "DEFAULT_THROTTLE_CLASSES": (

api/test/unit/utils/drf_renderer_test.py

@@ -0,0 +1,64 @@
+from rest_framework.request import Request
+from rest_framework.views import APIView
+
+import pytest
+
+from catalog.api.utils.drf_renderer import BrowsableAPIRendererWithoutForms
+
+
+@pytest.fixture
+def api_request(request_factory):
+    return request_factory.get("/")
+
+
+@pytest.fixture
+def view():
+    return APIView.as_view()
+
+
+@pytest.fixture
+def response(view, api_request):
+    return view(api_request)
+
+
+def test_without_forms_renderer_context_should_not_show_edit_forms(
+    api_request, response
+):
+    """
+    See https://github.com/encode/django-rest-framework/blob/master/tests/test_renderers.py
+    for example of test setup.
+    """
+    cls = BrowsableAPIRendererWithoutForms()
+
+    parent_context = {
+        "view": APIView(),
+        "request": Request(api_request),
+        "response": response,
+    }
+
+    ctx = cls.get_context({}, "text/html", parent_context)
+
+    assert ctx["display_edit_forms"] is False
+
+
+parametrize_methods = pytest.mark.parametrize(
+    "method", ("GET", "PUT", "POST", "DELETE", "OPTIONS")
+)
+
+
+@parametrize_methods
+def test_without_forms_renderer_show_form_for_method_returns_false(
+    method, api_request, view
+):
+    cls = BrowsableAPIRendererWithoutForms()
+
+    assert cls.show_form_for_method(view, method, api_request, None) is False
+
+
+@parametrize_methods
+def test_without_forms_renderer_get_rendered_html_form_empty(method, api_request, view):
+    cls = BrowsableAPIRendererWithoutForms()
+
+    data = {}
+
+    assert cls.get_rendered_html_form(data, view, method, api_request) == ""