merge with master

areas/users/user_service.py

@@ -1,5 +1,6 @@
 from database import db
 from areas.apps import App, AppRole, AppsService
+from areas.roles.role_service import RoleService
 from helpers import KratosApi
 
 from flask import current_app
@@ -57,14 +58,16 @@ class UserService:
         return UserService.get_user(res["id"])
 
     @staticmethod
-    def put_user(id, data):
+    def put_user(id, user_editing_id, data):
         kratos_data = {
             "schema_id": "default",
             "traits": {"email": data["email"], "name": data["name"]},
         }
         KratosApi.put("/admin/identities/{}".format(id), kratos_data)
 
-        if data["app_roles"]:
+        is_admin = RoleService.is_user_admin(user_editing_id)
+
+        if is_admin and data["app_roles"]:
             app_roles = data["app_roles"]
             for ar in app_roles:
                 app = App.query.filter_by(slug=ar["name"]).first()

areas/users/users.py

@@ -1,5 +1,5 @@
 from flask import jsonify, request
-from flask_jwt_extended import jwt_required
+from flask_jwt_extended import get_jwt, jwt_required
 from flask_cors import cross_origin
 from flask_expects_json import expects_json
 
@@ -23,6 +23,7 @@ def get_users():
 @api_v1.route("/users/<string:id>", methods=["GET"])
 @jwt_required()
 @cross_origin()
+@admin_required()
 def get_user(id):
     res = UserService.get_user(id)
     return jsonify(res)
@@ -43,9 +44,11 @@ def post_user():
 @jwt_required()
 @cross_origin()
 @expects_json(schema)
+@admin_required()
 def put_user(id):
     data = request.get_json()
-    res = UserService.put_user(id, data)
+    user_id = __get_user_id_from_jwt()
+    res = UserService.put_user(id, user_id, data)
     return jsonify(res)
 
 
@@ -70,3 +73,28 @@ def post_multiple_users():
     data = request.get_json()
     res = UserService.post_multiple_users(data)
     return jsonify(res)
+
+
+@api_v1.route("/me", methods=["GET"])
+@jwt_required()
+@cross_origin()
+def get_personal_info():
+    user_id = __get_user_id_from_jwt()
+    res = UserService.get_user(user_id)
+    return jsonify(res)
+
+
+@api_v1.route("/me", methods=["PUT"])
+@jwt_required()
+@cross_origin()
+@expects_json(schema)
+def update_personal_info():
+    data = request.get_json()
+    user_id = __get_user_id_from_jwt()
+    res = UserService.put_user(user_id, user_id, data)
+    return jsonify(res)
+
+
+def __get_user_id_from_jwt():
+    claims = get_jwt()
+    return claims["user_id"]