api for post upload

Makefile

@@ -20,3 +20,7 @@ messagesde:
 requirements: pyproject.toml
 	uv pip compile -o requirements.txt pyproject.toml
 	uv pip compile -o requirements-test.txt --extra test pyproject.toml
+
+openapi:
+	python manage.py generateschema --file froide/openapi-schema.yaml
+	pnpm run openapi

froide/foirequest/admin.py

@@ -22,6 +22,7 @@
 
 from froide.account.models import UserTag
 from froide.comments.models import FroideComment
+from froide.foirequest.models.message import FoiMessageDraft
 from froide.guide.models import Action
 from froide.guide.utils import assign_guidance_action
 from froide.helper.admin_utils import (
@@ -522,7 +523,6 @@ class MessageTagsFilter(MultiFilterMixin, TaggitListFilter):
 class FoiMessageAdmin(admin.ModelAdmin):
     save_on_top = True
     list_display = (
-        "is_draft",
         "subject",
         "timestamp",
         "message_page",
@@ -600,9 +600,7 @@ def get_urls(self):
         return my_urls + urls
 
     def get_queryset(self, request):
-        qs = super(FoiMessageAdmin, self).get_queryset(request)
-        qs = qs.prefetch_related("deliverystatus")
-        return qs
+        return self.model.objects.with_drafts(False).prefetch_related("deliverystatus")
 
     def save_model(self, request, obj, form, change):
         if (
@@ -752,6 +750,12 @@ def add_comment(
         )
 
 
+@admin.register(FoiMessageDraft)
+class FoiMessageDraftAdmin(FoiMessageAdmin):
+    def get_queryset(self, request):
+        return self.model.objects.all().prefetch_related("deliverystatus")
+
+
 @admin.register(MessageTag)
 class MessageTagAdmin(admin.ModelAdmin):
     prepopulated_fields = {"slug": ("name",)}

froide/foirequest/api/permissions.py

@@ -0,0 +1,16 @@
+from rest_framework import permissions
+from rest_framework.views import Request
+
+from ..auth import can_write_foirequest
+
+
+class OwnsFoiRequestPermission(permissions.BasePermission):
+    def __init__(self, request_field: str = "request") -> None:
+        self.request_field = request_field
+        super().__init__()
+
+    def has_object_permission(self, request: Request, view, obj):
+        if request.method in permissions.SAFE_METHODS:
+            return True
+
+        return can_write_foirequest(getattr(obj, self.request_field), request)