REST API app updates

- Add back support for API views but using the
api_urlpatterns list. Needed for the current user
API until a dynamic route router is implemented that
can allow a viewset action to specify its entire URL.

- Make sure the user is authenticated before
trying to the user permissions.

- Improve how external_object_list options are read from
the class.

- None authenticated users will get a blank queryset if the
view doesn't require a permission.

Signed-off-by: Roberto Rosario <Roberto.Rosario@mayan-edms.com>

mayan/apps/rest_api/apps.py

@@ -36,9 +36,22 @@ class RESTAPIApp(MayanAppConfig):
         for app in apps.get_app_configs():
             if getattr(app, 'has_rest_api', False):
                 try:
-                    for entry in import_string('{}.urls.api_router_entries'.format(app.name)):
-                        router.register(**entry)
+                    app_api_router_entries = import_string(
+                        dotted_path='{}.urls.api_router_entries'.format(app.name)
+                    )
                 except ImportError:
                     pass
+                else:
+                    for entry in app_api_router_entries:
+                        router.register(**entry)
+
+                try:
+                    app_api_urlpatterns = import_string(
+                        dotted_path='{}.urls.api_urlpatterns'.format(app.name)
+                    )
+                except ImportError:
+                    pass
+                else:
+                    urlpatterns.extend(app_api_urlpatterns)
 
         urlpatterns.extend(router.urls)