Add /api/notes to get and post notes

notes/serializers.py

@@ -0,0 +1,53 @@
+from datetime import timedelta
+from django.utils import timezone
+from rest_framework import serializers
+
+from notes.models import Note, User
+
+
+class UserSerializer(serializers.ModelSerializer):
+    username = serializers.CharField(max_length=150)
+    class Meta:
+        model = User
+        fields = ["id", "username", "first_name", "last_name"]
+        read_only_fields = ["id", "first_name", "last_name"]
+
+
+class NoteSerializer(serializers.ModelSerializer):
+    from_user = UserSerializer(read_only=True)
+    to_user = UserSerializer()
+
+    class Meta:
+        model = Note
+        fields = [
+            "from_user",
+            "to_user",
+            "note",
+            "expiry",
+            "created_at",
+        ]
+        read_only_fields = [
+            "from_user",
+            "created_at",
+            "expiry",
+        ]
+
+    def validate_to_user(self, value):
+        try:
+            user = User.objects.get(username=value['username'])
+        except User.DoesNotExist:
+            raise serializers.ValidationError("User not found")
+
+        current_user = self.context['request'].user
+        if not current_user.allowed_notes_to.filter(pk=user.pk).exists():
+            raise serializers.ValidationError(f"User not allowed to post notes to {user!r}")
+        return user
+
+    def save(self, **kwargs):
+        to_user = self.validated_data['to_user']
+        return Note.objects.create(
+            from_user=self.context['request'].user,
+            to_user=to_user,
+            note=self.validated_data['note'],
+            expiry=timezone.now() + timedelta(seconds=to_user.expiry_seconds)
+        )