OAuth support

[tomchristie]

Support for OAuth 1.0a and OAuth 2

[tomchristie]

@dulaccc, @swistakm - If you have twitter handles, can you let me know them, so I know who to thank when this gets released? :)

[tomchristie]

Ideally the docs could do with a bit more polishing but otherwise I think this is basically good-to-go.
Thanks so much!

[tomchristie]

Note: if either of you have anything else you think needs adding/atering before this hits master, you can make PRs against the oauth branch in the meantime, and they'll be added to this PR.

[dulacp]

@tomchristie my twitter handle is the same as my github one : )

Note: if either of you have anything else you think needs adding/atering before this hits master, you can make PRs against the oauth branch in the meantime, and they'll be added to this PR.

Nothing special is coming to my mind, but I'll sure let you know and PR on the oauth branch otherwise.

By the way, it's always a pleasure to give a hand on a great project, and django-rest-framework is definitely one of them!

[noirbizarre]

It seems really interesting!!! It's a must-have feature.

Do you plan to merge it into the master soon ?
Do you know which release is targeted ?

[tomchristie]

@noirbizarre Yup the plan is for this to make it in soon.

One last thing I would ideally like to see before this gets merged is a permission class that works together with these oauth authentication classes. Something along these lines...

class TokenHasReadWriteScope(BasePermission):
    def has_permissions(self, request, view):
        if not request.token:
            return False

        read_only = request.method in permissions.SAFE_METHODS:
        if hasattr(request.token, 'resource'):
            ... # django-oauth-plus token - Check `request.token.resource.is_readonly` as appropriate
        elif hasattr(request.token, 'scope'):
            ... # django-oauth2-provider token - Check `request.token.scope` is 'read' or 'write' as appropriate
        else:
            # Improperly configured!

@swistakm, @dulaccc, @noirbizarre - Anyone fancy taking that on plus tests and issuing a PR against the oauth branch? ;)

[dulacp]

I've some time today, so I can try to integrate that.
@tomchristie how many hours do I get ? I like challenges ;)

[dulacp]

Done. #721

[dulacp]

@thedrow ^^ thanks!

[tomchristie]

@thedrow - I've actually no good excuse at all for being slack regarding history, and particularly wrt. to failing tests you make a really good point. Could def be persuaded to clean up my act. :)