api.main: perform authorization for GET '/users'

[JenySadadia]

Only allow authorized users to get existing users' details to protect user's personal information.

[nuclearcat]

Verified manually using curl:

curl -X GET "$URI/latest/users"     -H 'accept: application/json'     -H "Authorization: Bearer $TOKEN"     -H 'Content-Type: application/json'
{"items":[{"id":"64705c1ae76325f50371875e","emai....
and
curl -X GET "$URI/latest/users"     -H 'accept: application/json' -H 'Content-Type: application/json'
{"detail":"Unauthorized"}

[nuclearcat]

It works! :)

[gctucker]

But, this should only be returning public information. I think it's a step backwards, being able to find user information publicly makes sense and all public web services do this. Also, if all it takes is a user account then I would argue it's a false sense of security as it's not preventing any personal user data from being shared with other individuals.

[nuclearcat]

Email is not public information, at least. I think it is better to move this discussion to Slack.

[gctucker]

I can see your email address on your public profile here ;) https://github.com/nuclearcat

[nuclearcat]

Yes, that intentional and github explicitly shows it will be published on github profile page.
But even this one good as example, it is my personal address for low priority stuff, but not the one i use for github authentication, notifications and important business emails.

[gctucker]

Yes, I know :) As discussed on Slack now. Maybe a GitHub issue or discussion about how to manage users in general would be good actually.