Repository: hydroshare/hydroshare

Issue:
hsapi /scimeta/elements endpoint errors with no authentication
**Description of the bug**
/scimeta/elements hsapi endpoint responds with a system error when no authentication credentials are provided.

Steps to reproduce the bug:
1. Go to https://www.hydroshare.org/hsapi/resource/16b27156f2b1483099f09d3b688e43fb/scimeta/elements/
1. See error

**Expected behavior**
API endpoints should handle requests that do not provide authentication.  Unauthenticated requests that make publicly accessible requests should provide a response.  Unauthenticated requests that make privately accessible requests should respond with a 403.

**Additional information**
Environment:


Request Method: GET
Request URL: http://localhost:8000/hsapi/resource/068d77bb3f4c442194e9f08056aca1cf/scimeta/elements/

Django Version: 1.11.29
Python Version: 3.6.9
Installed Applications:
('mezzanine.boot',
 'test_without_migrations',
 'autocomplete_light',
 'django.contrib.auth',
 'oauth2_provider',
 'corsheaders',
 'django.contrib.contenttypes',
 'django.contrib.redirects',
 'django.contrib.sessions',
 'django.contrib.sites',
 'django.contrib.sitemaps',
 'django.contrib.gis',
 'django.contrib.postgres',
 'inplaceeditform',
 'django_nose',
 'django_irods',
 'drf_yasg',
 'theme',
 'theme.blog_mods',
 'heartbeat',
 'mezzanine.conf',
 'mezzanine.core',
 'mezzanine.generic',
 'mezzanine.blog',
 'mezzanine.forms',
 'mezzanine.pages',
 'mezzanine.galleries',
 'crispy_forms',
 'mezzanine.accounts',
 'haystack',
 'rest_framework',
 'robots',
 'hs_core',
 'hs_access_control',
 'hs_labels',
 'hs_metrics',
 'irods_browser_app',
 'hs_geo_raster_resource',
 'ref_ts',
 'hs_app_timeseries',
 'widget_tweaks',
 'hs_app_netCDF',
 'hs_model_program',
 'hs_modelinstance',
 'hs_tools_resource',
 'hs_swat_modelinstance',
 'hs_geographic_feature_resource',
 'hs_script_resource',
 'hs_sitemap',
 'hs_collection_resource',
 'hs_modflow_modelinstance',
 'hs_tracking',
 'hs_file_types',
 'hs_composite_resource',
 'hs_rest_api',
 'hs_dictionary',
 'hs_odm2',
 'security',
 'markdown',
 'hs_communities',
 'hs_discover',
 'debug_toolbar',
 'filebrowser_safe',
 'grappelli_safe',
 'django.contrib.admin',
 'django.contrib.staticfiles',
 'django_comments')
Installed Middleware:
('django.contrib.sessions.middleware.SessionMiddleware',
 'django.middleware.locale.LocaleMiddleware',
 'django.contrib.auth.middleware.AuthenticationMiddleware',
 'corsheaders.middleware.CorsMiddleware',
 'django.middleware.common.CommonMiddleware',
 'django.middleware.csrf.CsrfViewMiddleware',
 'django.contrib.messages.middleware.MessageMiddleware',
 'mezzanine.core.request.CurrentRequestMiddleware',
 'mezzanine.core.middleware.RedirectFallbackMiddleware',
 'mezzanine.core.middleware.AdminLoginInterfaceSelectorMiddleware',
 'mezzanine.core.middleware.SitePermissionMiddleware',
 'mezzanine.pages.middleware.PageMiddleware',
 'hs_core.robots.RobotFilter',
 'hs_tracking.middleware.Tracking',
 'debug_toolbar.middleware.DebugToolbarMiddleware')



Traceback:

File "/usr/local/lib/python3.6/site-packages/django/core/handlers/exception.py" in inner
  41.             response = get_response(request)

File "/usr/local/lib/python3.6/site-packages/django/core/handlers/base.py" in _get_response
  217.                 response = self.process_exception_by_middleware(e, request)

File "/usr/local/lib/python3.6/site-packages/django/core/handlers/base.py" in _get_response
  215.                 response = response.render()

File "/usr/local/lib/python3.6/site-packages/django/template/response.py" in render
  107.             self.content = self.rendered_content

File "/usr/local/lib/python3.6/site-packages/rest_framework/response.py" in rendered_content
  70.         ret = renderer.render(self.data, accepted_media_type, context)

File "/usr/local/lib/python3.6/site-packages/rest_framework/renderers.py" in render
  724.         context = self.get_context(data, accepted_media_type, renderer_context)

File "/usr/local/lib/python3.6/site-packages/rest_framework/renderers.py" in get_context
  656.         raw_data_put_form = self.get_raw_data_form(data, view, 'PUT', request)

File "/usr/local/lib/python3.6/site-packages/rest_framework/renderers.py" in get_raw_data_form
  552.                     serializer = view.get_serializer(instance=instance)

File "/usr/local/lib/python3.6/site-packages/rest_framework/generics.py" in get_serializer
  110.         return serializer_class(*args, **kwargs)

Exception Type: TypeError at /hsapi/resource/068d77bb3f4c442194e9f08056aca1cf/scimeta/elements/
Exception Value: 'CoreMetaDataSerializer' object is not callable




Discussion:
Note that this is only a problem if you make the request in the browser, curl works fine.  It's annoying but probably a low priority.
This may be remedied by implementing create/update methods on the CoreMetadataSerializer class.  BaseSerializer does not implement those methods.

Resolving patch:
diff --git a/hs_core/views/resource_metadata_rest_api.py b/hs_core/views/resource_metadata_rest_api.py
--- a/hs_core/views/resource_metadata_rest_api.py
+++ b/hs_core/views/resource_metadata_rest_api.py
@@ -179,7 +179,6 @@ def get(self, request, pk):
         view_utils.authorize(request, pk, needed_permission=ACTION_TO_AUTHORIZE.VIEW_METADATA)
         resource = hydroshare.get_resource_by_shortkey(shortkey=pk)
         serializer = resource.metadata.serializer
-        self.serializer_class = resource.metadata.serializer
         return Response(data=serializer.data, status=status.HTTP_200_OK)
 
     def put(self, request, pk):
@@ -206,5 +205,4 @@ def put(self, request, pk):
 
         resource = hydroshare.get_resource_by_shortkey(shortkey=pk)
         serializer = resource.metadata.serializer
-        self.serializer_class = serializer
         return Response(data=serializer.data, status=status.HTTP_202_ACCEPTED)


Test patch: