django-pfx 1.4.dev102__tar.gz → 1.4.dev106__tar.gz

{django_pfx-1.4.dev102 → django_pfx-1.4.dev106}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: django-pfx
-Version: 1.4.dev102
+Version: 1.4.dev106
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com
@@ -34,6 +34,7 @@ Requires-Dist: apispec
 Requires-Dist: pyyaml
 Requires-Dist: pytz
 Requires-Dist: dill
+Requires-Dist: nh3
 Provides-Extra: otp
 Requires-Dist: pyotp; extra == "otp"
 

{django_pfx-1.4.dev102 → django_pfx-1.4.dev106}/django_pfx.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: django-pfx
-Version: 1.4.dev102
+Version: 1.4.dev106
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com
@@ -34,6 +34,7 @@ Requires-Dist: apispec
 Requires-Dist: pyyaml
 Requires-Dist: pytz
 Requires-Dist: dill
+Requires-Dist: nh3
 Provides-Extra: otp
 Requires-Dist: pyotp; extra == "otp"
 

{django_pfx-1.4.dev102 → django_pfx-1.4.dev106}/django_pfx.egg-info/SOURCES.txt

@@ -37,7 +37,6 @@ pfx/pfxcore/__init__.py
 pfx/pfxcore/apps.py
 pfx/pfxcore/default_settings.py
 pfx/pfxcore/exceptions.py
-pfx/pfxcore/fields.py
 pfx/pfxcore/settings.py
 pfx/pfxcore/shortcuts.py
 pfx/pfxcore/test.py
@@ -48,6 +47,10 @@ pfx/pfxcore/apidoc/schema.py
 pfx/pfxcore/apidoc/tags.py
 pfx/pfxcore/decorator/__init__.py
 pfx/pfxcore/decorator/rest.py
+pfx/pfxcore/fields/__init__.py
+pfx/pfxcore/fields/media_field.py
+pfx/pfxcore/fields/minutes_duration_field.py
+pfx/pfxcore/fields/nh3_field.py
 pfx/pfxcore/http/__init__.py
 pfx/pfxcore/http/json_response.py
 pfx/pfxcore/locale/fr/LC_MESSAGES/django.mo
@@ -79,6 +82,8 @@ pfx/pfxcore/models/user_filtered_queryset_mixin.py
 pfx/pfxcore/serializers/__init__.py
 pfx/pfxcore/serializers/json.py
 pfx/pfxcore/storage/__init__.py
+pfx/pfxcore/storage/exceptions.py
+pfx/pfxcore/storage/local_storage.py
 pfx/pfxcore/storage/s3_storage.py
 pfx/pfxcore/templates/registration/otp_code_email.txt
 pfx/pfxcore/templates/registration/otp_code_subject.txt
@@ -91,6 +96,7 @@ pfx/pfxcore/views/authentication_views.py
 pfx/pfxcore/views/fields.py
 pfx/pfxcore/views/filters_views.py
 pfx/pfxcore/views/locale_views.py
+pfx/pfxcore/views/media_rest_view_mixin.py
 pfx/pfxcore/views/ordered_rest_view_mixin.py
 pfx/pfxcore/views/rest_views.py
 pfx/pfxcore/views/parameters/__init__.py
@@ -138,6 +144,7 @@ tests/tests/test_cache.py
 tests/tests/test_client.py
 tests/tests/test_fields_choices.py
 tests/tests/test_fields_minutes_duration.py
+tests/tests/test_fields_nh3.py
 tests/tests/test_filters.py
 tests/tests/test_locale_api.py
 tests/tests/test_ordered_rest_view_mixin.py

{django_pfx-1.4.dev102 → django_pfx-1.4.dev106}/django_pfx.egg-info/requires.txt

@@ -7,6 +7,7 @@ apispec
 pyyaml
 pytz
 dill
+nh3
 
 [otp]
 pyotp

{django_pfx-1.4.dev102 → django_pfx-1.4.dev106}/pfx/pfxcore/default_settings.py

@@ -21,6 +21,8 @@ PFX_OPENAPI_TEMPLATE = {}
 PFX_PROFILING_SQL = ""
 PFX_PROFILING_CPROFILE = ""
 
+STORAGE_DEFAULT = None
+
 STORAGE_S3_AWS_REGION = None
 STORAGE_S3_AWS_ACCESS_KEY = None
 STORAGE_S3_AWS_SECRET_KEY = None
@@ -29,6 +31,9 @@ STORAGE_S3_AWS_S3_BUCKET = None
 STORAGE_S3_AWS_PUT_URL_EXPIRE = None
 STORAGE_S3_AWS_GET_URL_EXPIRE = None
 
+STORAGE_LOCAL_ROOT = None
+STORAGE_LOCAL_X_ACCEL_REDIRECT = False
+
 PFX_TEST_MODE = False
 
 PFX_AUTH_GROUPS_CREATE_ONLY = False

django_pfx-1.4.dev106/pfx/pfxcore/fields/__init__.py

@@ -0,0 +1,3 @@
+from .media_field import MediaField
+from .minutes_duration_field import MinutesDurationField
+from .nh3_field import NH3Field

django_pfx-1.4.dev106/pfx/pfxcore/fields/media_field.py

@@ -0,0 +1,60 @@
+import logging
+from importlib import import_module
+
+from django.db import models
+from django.db.models.signals import post_delete
+from django.dispatch import receiver
+
+from pfx.pfxcore.shortcuts import settings
+
+logger = logging.getLogger(__name__)
+
+
+def get_storage_class(class_path):
+    ps = class_path.split('.')
+    return getattr(import_module('.'.join(ps[:-1])), ps[-1])()
+
+
+class MediaField(models.JSONField):
+    def __init__(
+            self, *args, max_length=255, get_key=None, storage=None,
+            auto_delete=False, **kwargs):
+        self.get_key = get_key or self.get_default_key
+        if not storage and not settings.STORAGE_DEFAULT:
+            raise Exception(
+                "Missing storage. You have to set a storage "
+                "class on the field or define STORAGE_DEFAULT settings.")
+        self.storage = storage or get_storage_class(settings.STORAGE_DEFAULT)
+        self.auto_delete = auto_delete
+        super().__init__(
+            *args, max_length=max_length,
+            default=kwargs.pop('default', dict),
+            blank=kwargs.pop('blank', True),
+            **kwargs)
+
+    @staticmethod
+    def get_default_key(obj, filename):
+        return f"{type(obj).__name__}/{obj.pk}/{filename}"
+
+    def to_python(self, value):
+        return super().to_python(self.storage.to_python(value))
+
+    def get_upload_url(self, request, obj, filename):
+        key = self.get_key(obj, filename)
+        url = self.storage.get_upload_url(request, key)
+        return dict(url=url, file=dict(name=filename, key=key))
+
+    def get_url(self, request, obj):
+        return self.storage.get_url(
+            request, self.value_from_object(obj)['key'])
+
+    def upload(self, obj, file, filename, **kwargs):
+        key = self.get_key(obj, filename)
+        return self.to_python(self.storage.upload(key, file, **kwargs))
+
+
+@receiver(post_delete)
+def post_delete_media(sender, instance, **kwargs):
+    for field in sender._meta.fields:
+        if isinstance(field, MediaField) and field.auto_delete:
+            field.storage.delete(field.value_from_object(instance))

django_pfx-1.4.dev102/pfx/pfxcore/fields.py → django_pfx-1.4.dev106/pfx/pfxcore/fields/minutes_duration_field.py

@@ -4,57 +4,11 @@ from datetime import timedelta
 
 from django.core.exceptions import ValidationError
 from django.db import models
-from django.db.models.signals import post_delete
-from django.dispatch import receiver
 from django.utils.translation import gettext_lazy as _
 
-from pfx.pfxcore.storage import DefaultStorage
-
 logger = logging.getLogger(__name__)
 
 
-class MediaField(models.JSONField):
-    def __init__(
-            self, *args, max_length=255, get_key=None, storage=None,
-            auto_delete=False, **kwargs):
-        self.get_key = get_key or self.get_default_key
-        self.storage = storage or DefaultStorage()
-        self.auto_delete = auto_delete
-        super().__init__(
-            *args, max_length=max_length,
-            default=kwargs.pop('default', dict),
-            blank=kwargs.pop('blank', True),
-            **kwargs)
-
-    @staticmethod
-    def get_default_key(obj, filename):
-        return f"{type(obj).__name__}/{obj.pk}/{filename}"
-
-    def to_python(self, value):
-        return super().to_python(self.storage.to_python(value))
-
-    def get_upload_url(self, request, obj, filename):
-        key = self.get_key(obj, filename)
-        url = self.storage.get_upload_url(request, key)
-        return dict(url=url, file=dict(name=filename, key=key))
-
-    def get_url(self, request, obj):
-        return self.storage.get_url(
-            request, self.value_from_object(obj)['key'])
-
-    def upload(self, obj, file, filename, **kwargs):
-        key = self.get_key(obj, filename)
-        self.storage.upload(key, file, **kwargs)
-        return self.to_python(dict(key=key))
-
-
-@receiver(post_delete)
-def post_delete_media(sender, instance, **kwargs):
-    for field in sender._meta.fields:
-        if isinstance(field, MediaField) and field.auto_delete:
-            field.storage.delete(field.value_from_object(instance))
-
-
 class MinutesDurationField(models.DurationField):
     RE_FLOAT = re.compile(r'^[0-9]*(\.[0-9]*)?$')
     RE_HH_MM = re.compile(r'^([0-9]*):([0-5][0-9])?$')

django_pfx-1.4.dev106/pfx/pfxcore/fields/nh3_field.py

@@ -0,0 +1,83 @@
+from django.conf import settings
+from django.db import models
+from django.utils.safestring import mark_safe
+
+import nh3
+
+
+def get_nh3_default_options():
+    nh3_args = {}
+    nh3_settings = {
+        "NH3_ALLOWED_TAGS": "tags",
+        "NH3_ALLOWED_ATTRIBUTES": "attributes",
+        "NH3_STRIP_COMMENTS": "strip_comments",
+        "NH3_URL_SCHEMES": "url_schemes",
+        "NH3_ATTRIBUTE_FILTER": "attribute_filter",
+        "NH3_LINK_REL": "link_rel",
+        "NH3_GENERIC_ATTRIBUTE_PREFIXES": "generic_attribute_prefixes",
+        "NH3_TAG_ATTRIBUTE_VALUES": "tag_attribute_values",
+        "NH3_SET_TAG_ATTRIBUTE_VALUES": "set_tag_attribute_values",
+    }
+
+    for setting, kwarg in nh3_settings.items():
+        if hasattr(settings, setting):
+            attr = getattr(settings, setting)
+            nh3_args[kwarg] = attr
+
+    return nh3_args
+
+
+class NH3Field(models.TextField):
+    def __init__(
+        self,
+        allowed_tags=None,
+        allowed_attributes=None,
+        url_schemes=None,
+        strip_comments=None,
+        attribute_filter=None,
+        link_rel=None,
+        generic_attribute_prefixes=None,
+        tag_attribute_values=None,
+        set_tag_attribute_values=None,
+        *args,
+        **kwargs,
+    ):
+        super().__init__(*args, **kwargs)
+
+        self.nh3_kwargs = get_nh3_default_options()
+
+        if allowed_tags:
+            self.nh3_kwargs["tags"] = allowed_tags
+        if allowed_attributes:
+            self.nh3_kwargs["attributes"] = allowed_attributes
+        if url_schemes:
+            self.nh3_kwargs["url_schemes"] = url_schemes
+        if strip_comments:
+            self.nh3_kwargs["strip_comments"] = strip_comments
+        if attribute_filter:
+            self.nh3_kwargs["attribute_filter"] = attribute_filter
+        if link_rel:
+            self.nh3_kwargs["link_rel"] = link_rel
+        if generic_attribute_prefixes:
+            self.nh3_kwargs["generic_attribute_prefixes"] = (
+                generic_attribute_prefixes)
+        if tag_attribute_values:
+            self.nh3_kwargs["tag_attribute_values"] = tag_attribute_values
+        if set_tag_attribute_values:
+            self.nh3_kwargs["set_tag_attribute_values"] = (
+                set_tag_attribute_values)
+
+    def pre_save(self, model_instance, add):
+        data = getattr(model_instance, self.attname)
+        if data is None:
+            return data
+        clean_value = nh3.clean(data, **self.nh3_kwargs) if data else ""
+        setattr(model_instance, self.attname, mark_safe(clean_value))
+        return clean_value
+
+    def from_db_value(self, value, expression, connection):
+        if value is None:
+            return value
+        # Values are sanitised before saving, so any value returned from the DB
+        # is safe to render unescaped.
+        return mark_safe(value)

{django_pfx-1.4.dev102 → django_pfx-1.4.dev106}/pfx/pfxcore/locale/fr/LC_MESSAGES/django.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-02-17 15:16+0100\n"
+"POT-Creation-Date: 2025-03-18 12:26+0100\n"
 "PO-Revision-Date: 2021-06-22 23:31+0200\n"
 "Last-Translator: \n"
 "Language-Team: \n"
@@ -47,11 +47,11 @@ msgstr "Interdit"
 msgid "Resource not found"
 msgstr "Ressource non trouvée"
 
-#: fields.py:77
+#: fields/minutes_duration_field.py:31
 msgid "Invalid value."
 msgstr "Valeur invalide."
 
-#: fields.py:92
+#: fields/minutes_duration_field.py:46
 msgid ""
 "Invalid format, it can be a number in hours, “1:05”, “:05”, “1h 5m”, “1.5h” "
 "or “30m”."
@@ -267,6 +267,10 @@ msgstr "Un nouveau code d'authentification a été envoyé par e-mail."
 msgid "Invalid value for {filter} filter"
 msgstr "Valeur invalide pour le filtre {filter}"
 
+#: views/media_rest_view_mixin.py:95 views/media_rest_view_mixin.py:143
+msgid "Unexpected storage error"
+msgstr "Erreur de stockage inattendue"
+
 #: views/ordered_rest_view_mixin.py:32
 #, python-brace-format
 msgid "object parameter is mandatory for move={move}."
@@ -277,27 +281,23 @@ msgstr "Le paramètre object est requis pour move={move}."
 msgid "object {pk} does not exists in this move context."
 msgstr "object {pk} n'existe pas dans ce contexte de déplacement."
 
-#: views/rest_views.py:246
+#: views/rest_views.py:239
 #, python-brace-format
 msgid "{obj} cannot be deleted because it is referenced by other objects."
 msgstr ""
 "{obj} ne peut pas être supprimé car il est référencé par d’autres objets."
 
-#: views/rest_views.py:331
+#: views/rest_views.py:324
 #, python-brace-format
 msgid "{model} {obj} created."
 msgstr "{model} {obj} créé."
 
-#: views/rest_views.py:332
+#: views/rest_views.py:325
 #, python-brace-format
 msgid "{model} {obj} updated."
 msgstr "{model} {obj} modifié."
 
-#: views/rest_views.py:1177
+#: views/rest_views.py:1170
 #, python-brace-format
 msgid "{model} {obj} deleted."
 msgstr "{model} {obj} supprimé."
-
-#: views/rest_views.py:1276 views/rest_views.py:1316
-msgid "Unexpected storage error"
-msgstr "Erreur de stockage inattendue"

django_pfx-1.4.dev106/pfx/pfxcore/storage/__init__.py

@@ -0,0 +1,3 @@
+from .exceptions import StorageException
+from .local_storage import LocalStorage
+from .s3_storage import S3Storage

django_pfx-1.4.dev106/pfx/pfxcore/storage/exceptions.py

@@ -0,0 +1,3 @@
+
+class StorageException(Exception):
+    pass

django_pfx-1.4.dev106/pfx/pfxcore/storage/local_storage.py

@@ -0,0 +1,56 @@
+import hashlib
+import logging
+from pathlib import Path
+
+from django.http import FileResponse
+
+from pfx.pfxcore.shortcuts import settings
+
+logger = logging.getLogger(__name__)
+
+
+class LocalStorage:
+    direct = True
+
+    def to_python(self, value):
+        return value
+
+    def get_url(self, request, key):
+        return Path(settings.STORAGE_LOCAL_ROOT, key)
+
+    def upload(self, key, file, **kwargs):
+        key_list = key.split('/')
+        filename = key_list[-1]
+        relative_path = Path(*key_list[:-1])
+        dirname = Path(settings.STORAGE_LOCAL_ROOT, relative_path)
+        dirname.mkdir(parents=True, exist_ok=True)
+        ext = ''.join(filename.partition('.')[-2:])
+        hashname = f'{hashlib.sha1(file).hexdigest()}{ext}'
+        final_key = str(Path(relative_path, hashname))
+        with open(Path(dirname, hashname), 'wb') as f:
+            f.write(file)
+        with open(Path(dirname, hashname), 'rb') as f:
+            response = FileResponse(
+                f, as_attachment=True, filename=filename)
+            return {
+                'key': final_key,
+                'name': filename,
+                'content-length': response.get('Content-Length'),
+                'content-type': response.get('Content-Type'),
+            }
+
+    def delete(self, value):
+        if 'key' not in value:
+            return value  # pragma: no cover
+        path = Path(settings.STORAGE_LOCAL_ROOT, value['key'])
+        path.unlink(missing_ok=True)
+        while True:
+            path = path.parent
+            if path == Path(settings.STORAGE_LOCAL_ROOT):
+                break
+            if any(path.iterdir()):
+                break
+            try:
+                path.rmdir()
+            except FileNotFoundError:
+                pass

{django_pfx-1.4.dev102 → django_pfx-1.4.dev106}/pfx/pfxcore/storage/s3_storage.py

@@ -6,14 +6,14 @@ from botocore.exceptions import ClientError
 
 from pfx.pfxcore.shortcuts import settings
 
-logger = logging.getLogger(__name__)
-
+from .exceptions import StorageException
 
-class StorageException(Exception):
-    pass
+logger = logging.getLogger(__name__)
 
 
 class S3Storage:
+    direct = False
+
     @staticmethod
     def s3_client():
         return boto3.client(
@@ -60,15 +60,16 @@ class S3Storage:
     def upload(self, key, file, **kwargs):
         try:
             if isinstance(file, IOBase):
-                return self.s3_client().upload_fileobj(
+                self.s3_client().upload_fileobj(
                     file, settings.STORAGE_S3_AWS_S3_BUCKET, key,
                     ExtraArgs=kwargs)
             else:
-                return self.s3_client().upload_file(
+                self.s3_client().upload_file(
                     file, settings.STORAGE_S3_AWS_S3_BUCKET, key,
                     ExtraArgs=kwargs)
         except ClientError:
             raise StorageException
+        return dict(key=key)
 
     def delete(self, value):
         if 'key' not in value:

{django_pfx-1.4.dev102 → django_pfx-1.4.dev106}/pfx/pfxcore/views/__init__.py

@@ -8,6 +8,7 @@ from .authentication_views import (
 from .fields import VF, FieldType, ViewField, ViewModelField
 from .filters_views import Filter, FilterGroup, ModelFilter
 from .locale_views import LocaleRestView
+from .media_rest_view_mixin import MediaPermsRestViewMixin, MediaRestViewMixin
 from .ordered_rest_view_mixin import OrderedRestViewMixin
 from .rest_views import (
     BaseRestView,
@@ -20,8 +21,6 @@ from .rest_views import (
     DetailRestViewMixin,
     ListPermsRestViewMixin,
     ListRestViewMixin,
-    MediaPermsRestViewMixin,
-    MediaRestViewMixin,
     ModelBodyMixin,
     ModelMixin,
     ModelResponseMixin,

django_pfx-1.4.dev106/pfx/pfxcore/views/media_rest_view_mixin.py

@@ -0,0 +1,171 @@
+import logging
+
+from django.core.exceptions import FieldDoesNotExist
+from django.http import FileResponse, HttpResponse
+from django.shortcuts import redirect
+from django.utils.translation import gettext_lazy as _
+
+from pfx.pfxcore.decorator import rest_api
+from pfx.pfxcore.exceptions import APIError, NotFoundError
+from pfx.pfxcore.fields import MediaField
+from pfx.pfxcore.http import JsonResponse
+from pfx.pfxcore.shortcuts import get_bool, settings
+from pfx.pfxcore.storage.s3_storage import StorageException
+
+from . import parameters
+from .rest_views import ModelMixin
+
+logger = logging.getLogger(__name__)
+
+
+class MediaRestViewMixin(ModelMixin):
+    """Extension mixin to manage media fields."""
+
+    def _get_model_field(self, field):
+        try:
+            model_field = self.model._meta.get_field(field)
+            if not isinstance(model_field, MediaField):
+                raise NotFoundError  # pragma: no cover
+        except FieldDoesNotExist:  # pragma: no cover
+            raise NotFoundError
+        return model_field
+
+    @rest_api(
+        "/<int:pk>/<str:field>/upload-url/<str:filename>", method="get",
+        priority_doc=-8)
+    def field_media_upload_url(self, pk, field, filename, *args, **kwargs):
+        """Entrypoint for
+        :code:`GET /<int:pk>/<str:field>/upload-url/<str:filename>` route.
+
+        Get the upload URL for a media file.
+
+        :param pk: The object pk
+        :param field: The field name
+        :param filename: The file name
+        :returns: The JSON response
+        :rtype: :class:`JsonResponse`
+        ---
+        get:
+            summary: Get upload URL
+            description: |
+                Get upload URL for a `MediaField` field.
+
+                You can upload a file ont the received URL. When the upload
+                query is done, you have to confirm the process with an
+                update request (`PUT`) on {model}. The body of this request
+                must contain the name of the `MediaField` with the contents
+                of the `file` value in the response of this request.
+
+                1. `GET /<int:pk>/<str:field>/upload-url/<str:filename>`
+                    → `data`
+                2. `PUT data.url aFile Content-Type: aFile.type`
+                3. `PUT /<int:pk> {{field: data.file}}`
+            parameters extras:
+                pk: The {model} pk.
+                field: The {model} field name. Must be the name of
+                    a `MediaField` field.
+                filename: The desired filename.
+            responses:
+                200:
+                    description: The upload URL
+                    content:
+                        application/json:
+                            schema:
+                                properties:
+                                    url:
+                                        type: string
+                                        format: uri
+                                    file:
+                                        type: object
+                                        properties:
+                                            name:
+                                                type: string
+                                            key:
+                                                type: string
+        """
+        obj = self.get_object(pk=pk)
+        mediaField = self._get_model_field(field)
+        if mediaField.storage.direct:
+            raise APIError("Unavailable for direct storage")
+        try:
+            res = self._get_model_field(field).get_upload_url(
+                self.request, obj, filename)
+        except StorageException as e:  # pragma: no cover
+            logger.exception(e)
+            raise APIError(_("Unexpected storage error", status=500))
+        return JsonResponse(res)
+
+    @rest_api(
+        "/<int:pk>/<str:field>", method="get",
+        parameters=[parameters.MediaRedirect], priority_doc=-9)
+    def field_media_get(self, pk, field, *args, **kwargs):
+        """Entrypoint for :code:`GET /<int:pk>/<str:field>` route.
+
+        Get the download URL for a media file.
+
+        :param pk: The object pk
+        :param field: The field name
+        :returns: The JSON response
+        :rtype: :class:`JsonResponse`
+        ---
+        get:
+            summary: Get {model} file
+            description: Get the URL for a media field file.
+            parameters extras:
+                pk: the {model} pk
+                field: the {model} field name
+            responses:
+                200:
+                    description: |
+                        The file stream if storage is direct,
+                        otherwise the file URL, only if `redirect` is `false`.
+                    content:
+                        application/json:
+                            schema:
+                                properties:
+                                    url:
+                                        type: string
+                                        format: uri
+                        application/octet-stream:
+                            schema:
+                                type: file
+                302:
+                    description: |
+                        The redirect, for undirect storage
+                        if `redirect` is `true`.
+        """
+        obj = self.get_object(pk=pk)
+        mediaField = self._get_model_field(field)
+        try:
+            url = mediaField.get_url(self.request, obj)
+        except StorageException as e:  # pragma: no cover
+            logger.exception(e)
+            raise APIError(_("Unexpected storage error", status=500))
+
+        if mediaField.storage.direct:
+            filename = getattr(obj, field).get('name')
+            if settings.STORAGE_LOCAL_X_ACCEL_REDIRECT:
+                response = HttpResponse()
+                response["Content-Disposition"] = (
+                    f"attachment; filename={filename}")
+                response['X-Accel-Redirect'] = (
+                    f"/filestore/{getattr(obj, field).get('key')}")
+                return response
+            response = FileResponse(
+                open(mediaField.get_url(self.request, obj), 'rb'),
+                as_attachment=True, filename=getattr(obj, field).get('name'))
+            return response
+
+        if get_bool(self.request.GET, 'redirect'):
+            return redirect(url)
+        return JsonResponse(dict(url=url))
+
+
+class MediaPermsRestViewMixin(MediaRestViewMixin):
+    """Extension mixin to check permissions."""
+
+    def field_media_upload_url_perm(self, *args, **kwargs):
+        return self.request.user.has_perm(*self.get_model_perms('change'))
+
+    def field_media_get_perm(self, *args, **kwargs):
+        return self.request.user.has_perm(*self.get_model_perms('view'))