Add a user info scope and thread it through the code. Protect the org modification API.

endpoints/api/repository.py

@@ -1,16 +1,15 @@
 import logging
 import json
 
-from flask import current_app, request
+from flask import request
 
 from data import model
 from endpoints.api import (truthy_bool, format_date, nickname, log_action, validate_json_request,
                            require_repo_read, require_repo_write, require_repo_admin,
                            RepositoryParamResource, resource, query_param, parse_args, ApiResource,
-                           request_error, require_scope, Unauthorized, NotFound)
-from auth.permissions import (ReadRepositoryPermission, ModifyRepositoryPermission,
-                              AdministerRepositoryPermission, CreateRepositoryPermission)
-from auth.auth import process_auth
+                           request_error, require_scope, Unauthorized, NotFound, InvalidRequest)
+from auth.permissions import (ModifyRepositoryPermission, AdministerRepositoryPermission,
+                              CreateRepositoryPermission)
 from auth.auth_context import get_authenticated_user
 from auth import scopes
 
@@ -63,10 +62,11 @@ class RepositoryList(ApiResource):
   def post(self):
     """Create a new repository."""
     owner = get_authenticated_user()
-    if not owner:
-      raise Unauthorized()
-
     req = request.get_json()
+
+    if owner is None and 'namespace' not in 'req':
+      raise InvalidRequest('Must provide a namespace or must be logged in.')
+
     namespace_name = req['namespace'] if 'namespace' in req else owner.username
 
     permission = CreateRepositoryPermission(namespace_name)