User profile Visibility (#504)

* Adding user visibility

* Making the public field True by default

* Update app/controllers/users.py

Co-authored-by: Mubangizi Allan <mubangizia22@gmail.com>

* Update app/controllers/users.py

Co-authored-by: Mubangizi Allan <mubangizia22@gmail.com>

* Make field is_public

* refactor checks

---------

Co-authored-by: Mubangizi Allan <mubangizia22@gmail.com>

api_docs.yml

@@ -189,6 +189,10 @@ paths:
  produces:
  - application/json
  parameters:
+ - in: header
+ name: Authorization
+ required: true
+ description: "Bearer [token]"
  - in: path
  name: user_id
  required: true
@@ -201,6 +205,8 @@ paths:
  properties:
  name:
  type: string
+ is_public:
+ type: boolean
 
  responses:
  200:

app/controllers/users.py

@@ -15,6 +15,7 @@
 from app.helpers.token import validate_token
 from app.helpers.decorators import admin_required
 from app.helpers.pagination import paginate
+from app.helpers.admin import is_admin
 import requests
 import secrets
 import string
@@ -411,26 +412,33 @@ def delete(self, user_id):
  except Exception as e:
  return dict(status='fail', message=str(e)), 500
 
+ @jwt_required
  def patch(self, user_id):
  """
  """
  try:
- user_schema = UserSchema(only=("name",))
+ user_schema = UserSchema(only=("name", "is_public"))
 
  user_data = request.get_json()
 
+ current_user_id = get_jwt_identity()
+ current_user_roles = get_jwt_claims()['roles']
+
+ user = User.get_by_id(user_id)
+
+ if (current_user_id != user_id):
+ if (not is_admin(current_user_roles)):
+ return dict(
+ status = 'UnAuthorised',
+ message = 'You are not authorized to edit this users information'
+ ) , 401
+
+
  validate_user_data, errors = user_schema.load(user_data)
 
  if errors:
  return dict(status='fail', message=errors), 400
 
- user = User.get_by_id(user_id)
-
- if not user:
- return dict(
- status='fail',
- message=f'User {user_id} not found'
- ), 404
 
  updated = User.update(user, **validate_user_data)
 

app/models/user.py

@@ -51,6 +51,7 @@ class User(ModelMixin):
  'CreditAssignment', backref='user', lazy=True)
  disabled = db.Column(db.Boolean, default=False)
  admin_disabled = db.Column(db.Boolean, default=False)
+ is_public = db.Column(db.Boolean, default=True)
 
  def __init__(self, email, name, password, organisation=None):
  """ initialize with email, username and password """

app/schemas/user.py

@@ -38,6 +38,7 @@ class UserSchema(Schema):
  ])
  disabled = fields.Boolean(dump_only=True)
  admin_disabled = fields.Boolean(dump_only=True)
+ is_public = fields.Boolean()
 
  def get_age(self, obj):
  return get_item_age(obj.date_created)

migrations/versions/5f6dfc8f1b35_.py

@@ -0,0 +1,28 @@
+"""empty message
+
+Revision ID: 5f6dfc8f1b35
+Revises: bc50b6e9a79d
+Create Date: 2024-06-11 18:48:32.755879
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = '5f6dfc8f1b35'
+down_revision = 'bc50b6e9a79d'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+ # ### commands auto generated by Alembic - please adjust! ###
+ op.add_column('user', sa.Column('is_public', sa.Boolean(), nullable=True))
+ # ### end Alembic commands ###
+
+
+def downgrade():
+ # ### commands auto generated by Alembic - please adjust! ###
+ op.drop_column('user', 'is_public')
+ # ### end Alembic commands ###