from rest_framework import viewsets, permissions from rest_framework.exceptions import NotFound from django.contrib.auth import get_user_model from boxofficefantasy.models import Movie from draft.models import DraftSession, DraftPick from django.shortcuts import get_object_or_404 from rest_framework.response import Response from boxofficefantasy.integrations.tmdb import get_tmdb_movie_by_imdb from rest_framework.decorators import api_view from django.db.models import Prefetch from .serializers import ( UserSerializer, MovieSerializer, DraftSessionSerializer ) User = get_user_model() class UserViewSet(viewsets.ReadOnlyModelViewSet): queryset = User.objects.all() serializer_class = UserSerializer permission_classes = [permissions.IsAuthenticated] lookup_field = "username" class MovieViewSet(viewsets.ReadOnlyModelViewSet): queryset = Movie.objects.all().order_by('id') serializer_class = MovieSerializer permission_classes = [permissions.IsAuthenticated] class DraftSessionViewSet(viewsets.ReadOnlyModelViewSet): """ GET /api/drafts// Returns participants, movies, settings, and picks for a draft session. Access limited to participants or staff. """ serializer_class = DraftSessionSerializer # permission_classes = [permissions.IsAuthenticated, IsParticipantOfDraft] lookup_field = "hashid" # use hashed id instead of pk lookup_url_kwarg = "hid" # url kwarg name matches urls.py def get_object(self): hashid = self.kwargs[self.lookup_url_kwarg] pk = DraftSession.decode_id(hashid) if pk is None: raise NotFound("Invalid draft id.") obj = get_object_or_404(self.get_queryset(), pk=pk) # Trigger object-level permissions (participant check happens here) self.check_object_permissions(self.request, obj) return obj def get_queryset(self): # Optimize queries return ( DraftSession.objects .select_related("season", "settings") .prefetch_related( "participants", "movies", Prefetch("draft_picks", queryset=DraftPick.objects.select_related("winner", "movie")), ) ) @api_view(["GET"]) def movie_detail(request, movie_id): """ GET /api/movie/{movie_id}/detail Returns TMDB movie details and the movie is in that session. """ # Lookup DraftSession by hashid or pk # draft_session = get_object_or_404(DraftSession, hashid=draft_session_id) # # Ensure requesting user is a participant # if request.user not in draft_session.participants.all(): # return Response({"detail": "Not authorized for this draft session."}, # status=status.HTTP_403_FORBIDDEN) # # Get movie in this session movie = get_object_or_404(Movie, pk=movie_id) # Call TMDB integration tmdb_data = get_tmdb_movie_by_imdb(movie.imdb_id) if not tmdb_data: return Response({"detail": "Movie details not found."}, status=404) return Response({ "id": movie.id, "title": movie.title, "tmdb": tmdb_data })