Allow POST, PATCH, DELETE for actions in ReadOnlyModelViewSet (#797)

Currently if you try to use `POST` for action in `ReadOnlyModelViewSet` you will get problems:
- with DRF UI you will loose data input forms
- `drf_yasg` package will not generate OpenAPI specifications for such actions

This behavior was added to `django-rest-framework-json-api` in version 2.8.0 by mistake:

Commit: 7abd764
Subject: remove disallowed PUT method. (#643)

Author: kolomenkin

AUTHORS

@@ -19,6 +19,7 @@ Raphael Cohen <[email protected]>
 Roberto Barreda <[email protected]>
 Rohith PR <[email protected]>
 santiavenda <[email protected]>
+Sergey Kolomenkin <https://kolomenkin.com>
 Tim Selman <[email protected]>
 Yaniv Peer <[email protected]>
 Mohammed Ali Zubair <[email protected]>

CHANGELOG.md

@@ -18,6 +18,7 @@ any parts of the framework not mentioned in the documentation should generally b
 
 * Avoid `AttributeError` for PUT and PATCH methods when using `APIView`
 * Clear many-to-many relationships instead of deleting related objects during PATCH on `RelationshipView`
+* Allow POST, PATCH, DELETE for actions in `ReadOnlyModelViewSet`. It was problematic since 2.8.0.
 
 ### Changed
 

example/tests/test_views.py

@@ -3,11 +3,15 @@
 
 from django.test import RequestFactory
 from django.utils import timezone
+from rest_framework import status
+from rest_framework.decorators import action
 from rest_framework.exceptions import NotFound
 from rest_framework.request import Request
+from rest_framework.response import Response
 from rest_framework.reverse import reverse
 from rest_framework.test import APIRequestFactory, APITestCase, force_authenticate
 
+from rest_framework_json_api import serializers, views
 from rest_framework_json_api.utils import format_resource_type
 
 from example.factories import AuthorFactory, CommentFactory, EntryFactory
@@ -634,3 +638,67 @@ def test_get_object_gives_correct_entry(self):
         }
         got = resp.json()
         self.assertEqual(got, expected)
+
+
+class BasicAuthorSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Author
+        fields = ('name',)
+
+
+class ReadOnlyViewSetWithCustomActions(views.ReadOnlyModelViewSet):
+    queryset = Author.objects.all()
+    serializer_class = BasicAuthorSerializer
+
+    @action(detail=False, methods=['post', 'patch', 'delete'])
+    def group_action(self, request):
+        return Response(status=status.HTTP_204_NO_CONTENT)
+
+    @action(detail=True, methods=['post', 'patch', 'delete'])
+    def item_action(self, request, pk):
+        return Response(status=status.HTTP_204_NO_CONTENT)
+
+
+class TestReadonlyModelViewSet(TestBase):
+    """
+        Test if ReadOnlyModelViewSet allows to have custom actions with POST, PATCH, DELETE methods
+    """
+    factory = RequestFactory()
+    viewset_class = ReadOnlyViewSetWithCustomActions
+    media_type = 'application/vnd.api+json'
+
+    def test_group_action_allows_post(self):
+        view = self.viewset_class.as_view({'post': 'group_action'})
+        request = self.factory.post('/', '{}', content_type=self.media_type)
+        response = view(request)
+        self.assertEqual(status.HTTP_204_NO_CONTENT, response.status_code)
+
+    def test_group_action_allows_patch(self):
+        view = self.viewset_class.as_view({'patch': 'group_action'})
+        request = self.factory.patch('/', '{}', content_type=self.media_type)
+        response = view(request)
+        self.assertEqual(status.HTTP_204_NO_CONTENT, response.status_code)
+
+    def test_group_action_allows_delete(self):
+        view = self.viewset_class.as_view({'delete': 'group_action'})
+        request = self.factory.delete('/', '{}', content_type=self.media_type)
+        response = view(request)
+        self.assertEqual(status.HTTP_204_NO_CONTENT, response.status_code)
+
+    def test_item_action_allows_post(self):
+        view = self.viewset_class.as_view({'post': 'item_action'})
+        request = self.factory.post('/', '{}', content_type=self.media_type)
+        response = view(request, pk='1')
+        self.assertEqual(status.HTTP_204_NO_CONTENT, response.status_code)
+
+    def test_item_action_allows_patch(self):
+        view = self.viewset_class.as_view({'patch': 'item_action'})
+        request = self.factory.patch('/', '{}', content_type=self.media_type)
+        response = view(request, pk='1')
+        self.assertEqual(status.HTTP_204_NO_CONTENT, response.status_code)
+
+    def test_item_action_allows_delete(self):
+        view = self.viewset_class.as_view({'delete': 'item_action'})
+        request = self.factory.delete('/', '{}', content_type=self.media_type)
+        response = view(request, pk='1')
+        self.assertEqual(status.HTTP_204_NO_CONTENT, response.status_code)

rest_framework_json_api/views.py

@@ -210,7 +210,7 @@ class ModelViewSet(AutoPrefetchMixin,
 class ReadOnlyModelViewSet(AutoPrefetchMixin,
                            RelatedMixin,
                            viewsets.ReadOnlyModelViewSet):
-    http_method_names = ['get', 'head', 'options']
+    http_method_names = ['get', 'post', 'patch', 'delete', 'head', 'options']
 
 
 class RelationshipView(generics.GenericAPIView):