UserRetrievalAPIViews.py

class UserDetailAPIView(RetrieveAPIView):
    lookup_url_kwarg = 'username'
    queryset = User.objects.all()
    lookup_field = 'username__iexact'
    serializer_class = UserSerializer


class UserPostListAPIView(ListAPIView):
    serializer_class = PostSerializer
    permission_classes = (IsAuthenticated,)

    def get_queryset(self) -> QuerySet:
        username = self.kwargs['username']
        user = get_object_or_404(User, username__iexact=username)
        if user in self.request.user.following or not user.private:
            return Post.objects.filter(user__username__iexact=username)
        else:
            raise PermissionDenied('Follow user to see their posts.')