From 1a407848c86505b6491a2d11a269782154fd8582 Mon Sep 17 00:00:00 2001
From: Radek Czajka <rczajka@rczajka.pl>
Date: Wed, 24 Jul 2019 14:55:00 +0200
Subject: [PATCH 1/1] App workarounds.

---
 src/catalogue/api/fields.py          |  3 ++-
 src/catalogue/api/views.py           | 12 +++++++++---
 src/wolnelektury/settings/contrib.py |  1 +
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/catalogue/api/fields.py b/src/catalogue/api/fields.py
index 48c00958a..371da38ad 100644
--- a/src/catalogue/api/fields.py
+++ b/src/catalogue/api/fields.py
@@ -25,7 +25,8 @@ class BookLiked(serializers.ReadOnlyField):
 class EmbargoURLField(AbsoluteURLField):
     def to_representation(self, value):
         request = self.context['request']
-        if Membership.is_active_for(request.user):
+        # FIXME: See #3955.
+        if True or Membership.is_active_for(request.user):
             return super().to_representation(value)
         else:
             return None
diff --git a/src/catalogue/api/views.py b/src/catalogue/api/views.py
index c98695094..68626e6d6 100644
--- a/src/catalogue/api/views.py
+++ b/src/catalogue/api/views.py
@@ -11,6 +11,7 @@ from rest_framework.response import Response
 from rest_framework import status
 from api.handlers import read_tags
 from api.utils import vary_on_auth
+from club.models import Membership
 from .helpers import books_after, order_books
 from . import serializers
 from catalogue.forms import BookImportForm
@@ -71,6 +72,9 @@ class BookList(ListAPIView):
             books = Book.objects.all()
         books = order_books(books, new_api)
 
+        if not Membership.is_active_for(self.request.user):
+            books = books.exclude(preview=True)
+
         if self.kwargs.get('top_level'):
             books = books.filter(parent=None)
         if self.kwargs.get('audiobooks'):
@@ -147,15 +151,15 @@ class EbookList(BookList):
     serializer_class = serializers.EbookSerializer
 
 
-@vary_on_auth  # Because of 'liked'.
+@method_decorator(never_cache, name='dispatch')
 class Preview(ListAPIView):
     #queryset = Book.objects.filter(preview=True)
     serializer_class = serializers.BookPreviewSerializer
 
     def get_queryset(self):
         qs = Book.objects.filter(preview=True)
-        # FIXME: temporary workaround for a problem with iOS app.
-        if 'Darwin' in self.request.META['HTTP_USER_AGENT']:
+        # FIXME: temporary workaround for a problem with iOS app; see #3954.
+        if 'Darwin' in self.request.META['HTTP_USER_AGENT'] and 'debug' not in self.request.GET:
             qs = qs.none()
         return qs
 
@@ -176,6 +180,8 @@ class FilterBookList(ListAPIView):
         is_lektura = self.parse_bool(self.request.query_params.get('lektura'))
         is_audiobook = self.parse_bool(self.request.query_params.get('audiobook'))
         preview = self.parse_bool(self.request.query_params.get('preview'))
+        if not Membership.is_active_for(self.request.user):
+            preview = False
 
         new_api = self.request.query_params.get('new_api')
         after = self.request.query_params.get('after')
diff --git a/src/wolnelektury/settings/contrib.py b/src/wolnelektury/settings/contrib.py
index 5e89a6f90..bf2962bf8 100644
--- a/src/wolnelektury/settings/contrib.py
+++ b/src/wolnelektury/settings/contrib.py
@@ -39,6 +39,7 @@ REST_FRAMEWORK = {
     ),
     'DEFAULT_AUTHENTICATION_CLASSES': (
         'api.drf_auth.PistonOAuthAuthentication',
+        'rest_framework.authentication.SessionAuthentication',
     )
 }
 
-- 
2.20.1