API endpoint for updating privacy

api/funkwhale_api/users/views.py

@@ -1,4 +1,5 @@
 from rest_framework.response import Response
+from rest_framework import mixins
 from rest_framework import viewsets
 from rest_framework.decorators import list_route
 
@@ -23,12 +24,25 @@ class RegisterView(BaseRegisterView):
         return get_adapter().is_open_for_signup(request)
 
 
-class UserViewSet(viewsets.GenericViewSet):
+class UserViewSet(
+        mixins.UpdateModelMixin,
+        viewsets.GenericViewSet):
     queryset = models.User.objects.all()
-    serializer_class = serializers.UserSerializer
+    serializer_class = serializers.UserWriteSerializer
+    lookup_field = 'username'
 
     @list_route(methods=['get'])
     def me(self, request, *args, **kwargs):
         """Return information about the current user"""
-        serializer = self.serializer_class(request.user)
+        serializer = serializers.UserReadSerializer(request.user)
         return Response(serializer.data)
+
+    def update(self, request, *args, **kwargs):
+        if not self.request.user.username == kwargs.get('username'):
+            return Response(status=403)
+        return super().update(request, *args, **kwargs)
+
+    def partial_update(self, request, *args, **kwargs):
+        if not self.request.user.username == kwargs.get('username'):
+            return Response(status=403)
+        return super().partial_update(request, *args, **kwargs)