[PLAT-931] Retrieve/Delete User External Identities in APIv2

api/users/serializers.py

@@ -252,3 +252,17 @@ def get_absolute_url(self, obj):
 
     class Meta:
         type_ = 'institutions'
+
+
+class UserIdentitiesSerializer(BaseAPISerializer):
+    data = ser.DictField()
+    links = LinksField({'self': 'get_self_url'})
+
+    def get_self_url(self, obj):
+        return absolute_reverse('users:user-identities-list', kwargs={
+            'version': self.context['request'].parser_context['kwargs']['version'],
+            'user_id': obj['self']._id
+        })
+
+    class Meta:
+        type_ = 'external_identities'

api/users/urls.py

@@ -16,4 +16,6 @@
     url(r'^(?P<user_id>\w+)/registrations/$', views.UserRegistrations.as_view(), name=views.UserRegistrations.view_name),
     url(r'^(?P<user_id>\w+)/quickfiles/$', views.UserQuickFiles.as_view(), name=views.UserQuickFiles.view_name),
     url(r'^(?P<user_id>\w+)/relationships/institutions/$', views.UserInstitutionsRelationship.as_view(), name=views.UserInstitutionsRelationship.view_name),
+    url(r'^(?P<user_id>\w+)/settings/identities/$', views.UserIdentitiesList.as_view(), name=views.UserIdentitiesList.view_name),
+    url(r'^(?P<user_id>\w+)/settings/identities/(?P<identity_id>\w+)/$', views.UserIdentitiesDetail.as_view(), name=views.UserIdentitiesDetail.view_name),
 ]

api/users/views.py

@@ -21,6 +21,7 @@
                                    ReadOnlyOrCurrentUserRelationship)
 from api.users.serializers import (UserAddonSettingsSerializer,
                                    UserDetailSerializer,
+                                   UserIdentitiesSerializer,
                                    UserInstitutionsRelationshipSerializer,
                                    UserSerializer,
                                    UserQuickFilesSerializer,
@@ -436,3 +437,66 @@ def perform_destroy(self, instance):
             if val['id'] in current_institutions:
                 user.remove_institution(val['id'])
         user.save()
+
+
+class UserIdentitiesList(JSONAPIBaseView, generics.RetrieveAPIView, UserMixin):
+    """
+    REMEMBER TO WRITE DEV DOCS!!!
+    The documentation for this endpoint can be found [here](https://developer.osf.io/#operation/...).
+    """
+    permission_classes = (
+        base_permissions.TokenHasScope,
+        drf_permissions.IsAuthenticatedOrReadOnly,
+        CurrentUser,
+    )
+
+    serializer_class = UserIdentitiesSerializer
+
+    required_read_scopes = [CoreScopes.USERS_READ]
+    required_write_scopes = [CoreScopes.NULL]
+
+    view_category = 'users'
+    view_name = 'user-identities-list'
+
+    def get_object(self):
+        user = self.get_user()
+
+        return {'data': user.external_identity, 'self': user, 'type': 'external-identities'}
+
+
+class UserIdentitiesDetail(JSONAPIBaseView, generics.RetrieveDestroyAPIView, UserMixin):
+    """
+    REMEMBER TO WRITE DEV DOCS!!!
+    The documentation for this endpoint can be found [here](https://developer.osf.io/#operation/...).
+    """
+    permission_classes = (
+        base_permissions.TokenHasScope,
+        drf_permissions.IsAuthenticatedOrReadOnly,
+        CurrentUser,
+    )
+
+    required_read_scopes = [CoreScopes.USERS_READ]
+    required_write_scopes = [CoreScopes.USERS_WRITE]
+
+    serializer_class = UserIdentitiesSerializer
+
+    view_category = 'users'
+    view_name = 'user-identities-detail'
+
+    def get_object(self):
+        user = self.get_user()
+        identity_id = self.kwargs['identity_id']
+        try:
+            return {'data': {identity_id: user.external_identity[identity_id]}, 'self': user}
+        except KeyError:
+            raise NotFound('Requested external identity could not be found.')
+
+    def perform_destroy(self, instance):
+        user = self.get_user()
+        identity_id = self.kwargs['identity_id']
+        try:
+            user.external_identity.pop(identity_id)
+        except KeyError:
+            raise NotFound('Requested external identity could not be found.')
+
+        user.save()

api_tests/users/views/test_user_external_identities.py

@@ -0,0 +1,76 @@
+# -*- coding: utf-8 -*-
+import pytest
+
+from osf_tests.factories import AuthUserFactory
+from api.base.settings.defaults import API_BASE
+
+
+@pytest.fixture()
+def user():
+    user = AuthUserFactory()
+    user.external_identity = {
+        'ORCID': {
+            '0000-0001-9143-4653': 'VERIFIED'
+        },
+        'LOTUS': {
+            '0000-0001-9143-4652': 'LINK'
+        }
+    }
+    user.save()
+    return user
+
+
+@pytest.mark.django_db
+class TestUserIdentitiesList:
+
+    @pytest.fixture()
+    def url(self, user):
+        return '/{}users/{}/settings/identities/'.format(API_BASE, user._id)
+
+    def test_authorized_gets_200(self, app, user, url):
+        res = app.get(url, auth=user.auth)
+        assert res.status_code == 200
+        assert res.content_type == 'application/vnd.api+json'
+        assert res.json['data'] == {
+            'ORCID': {
+                '0000-0001-9143-4653': 'VERIFIED'
+            },
+            'LOTUS': {
+                '0000-0001-9143-4652': 'LINK'
+            }
+        }
+
+    def test_anonymous_gets_401(self, app, url):
+        res = app.get(url, expect_errors=True)
+        assert res.status_code == 401
+        assert res.content_type == 'application/vnd.api+json'
+
+
+@pytest.mark.django_db
+class TestUserIdentitiesDetail:
+
+    @pytest.fixture()
+    def url(self, user):
+        return '/{}users/{}/settings/identities/ORCID/'.format(API_BASE, user._id)
+
+    def test_authorized_gets_200(self, app, user, url):
+        res = app.get(url, auth=user.auth)
+        assert res.status_code == 200
+        assert res.content_type == 'application/vnd.api+json'
+        assert res.json['data'] == {'ORCID': {'0000-0001-9143-4653': 'VERIFIED'}}
+
+    def test_anonymous_gets_401(self, app, url):
+        res = app.get(url, expect_errors=True)
+        assert res.status_code == 401
+        assert res.content_type == 'application/vnd.api+json'
+
+    def test_authorized_delete_204(self, app, user, url):
+        res = app.delete(url, auth=user.auth)
+        assert res.status_code == 204
+
+        user.refresh_from_db()
+        assert user.external_identity == {
+            'LOTUS': {
+                '0000-0001-9143-4652': 'LINK'
+            }
+        }