Restrict GET /users API to authenticated users

app/api/models/user.py

@@ -17,17 +17,41 @@ def add_models_to_namespace(api_namespace):
         readOnly=True,
         description='The unique identifier of a user'
     ),
+    'username': fields.String(
+        required=True,
+        description='User username'
+    ),
     'name': fields.String(
         required=True,
         description='User name'
     ),
-    'username': fields.String(
+    'slack_username': fields.String(
         required=True,
-        description='User username'
+        description='User Slack username'
     ),
-    'email': fields.String(
+    'bio': fields.String(
         required=True,
-        description='User email'
+        description='User bio'
+    ),
+    'location': fields.String(
+        required=True,
+        description='User location'
+    ),
+    'interests': fields.String(
+        required=True,
+        description='User interests'
+    ),
+    'skills': fields.String(
+        required=True,
+        description='User skills'
+    ),
+    'need_mentoring': fields.Boolean(
+        required=True,
+        description='User need to be mentored indication'
+    ),
+    'available_to_mentor': fields.Boolean(
+        required=True,
+        description='User availability to mentor indication'
     )
 })
 

app/api/resources/user.py

@@ -16,12 +16,14 @@
 DAO = UserDAO()  # User data access object
 
 
-@users_ns.route('users/')
+@users_ns.route('users')
 class UserList(Resource):
 
     @classmethod
+    @jwt_required
     @users_ns.doc('list_users')
-    @users_ns.marshal_list_with(full_user_api_model)
+    @users_ns.marshal_list_with(public_user_api_model)
+    @users_ns.expect(auth_header_parser)
     def get(cls):
         """
         Returns list of all the users.
@@ -68,7 +70,7 @@ class MyUserProfile(Resource):
     @jwt_required
     @users_ns.doc('get_user')
     @users_ns.expect(auth_header_parser, validate=True)
-    @users_ns.marshal_with(public_user_api_model)  # , skip_none=True
+    @users_ns.marshal_with(full_user_api_model)  # , skip_none=True
     def get(cls):
         """
         Returns a user.
@@ -123,8 +125,10 @@ def put(cls):
 class VerifiedUser(Resource):
 
     @classmethod
+    @jwt_required
     @users_ns.doc('get_verified_users')
-    @users_ns.marshal_with(public_user_api_model)  # , skip_none=True
+    @users_ns.marshal_list_with(public_user_api_model)  # , skip_none=True
+    @users_ns.expect(auth_header_parser)
     def get(cls):
         """
         Returns all verified users.

app/database/db_utils.py

@@ -1,4 +1,4 @@
-from . import db
+from app.database.sqlalchemy_extension import db
 
 
 def reset_database():