REST API app updates

- Add back support for API views but using the
api_urlpatterns list. Needed for the current user
API until a dynamic route router is implemented that
can allow a viewset action to specify its entire URL.

- Make sure the user is authenticated before
trying to the user permissions.

- Improve how external_object_list options are read from
the class.

- None authenticated users will get a blank queryset if the
view doesn't require a permission.

Signed-off-by: Roberto Rosario <Roberto.Rosario@mayan-edms.com>

mayan/apps/rest_api/permissions.py

@@ -2,7 +2,7 @@ from __future__ import absolute_import, unicode_literals
 
 from django.core.exceptions import PermissionDenied
 
-from rest_framework.permissions import BasePermission
+from rest_framework.permissions import BasePermission, IsAuthenticated
 
 from mayan.apps.permissions import Permission
 
@@ -19,6 +19,9 @@ class MayanViewSetPermission(BasePermission):
             'list': permission_..._view
         }
         """
+        if not request.user or not request.user.is_authenticated:
+            return False
+
         view_permission_dictionary = getattr(view, 'view_permission_map', {})
         view_permission = view_permission_dictionary.get(view.action, None)