Add a user info scope and thread it through the code. Protect the org modification API.

endpoints/api/robot.py

@@ -1,5 +1,5 @@
 from endpoints.api import (resource, nickname, ApiResource, log_action, related_user_resource,
-                           Unauthorized)
+                           Unauthorized, require_user_admin)
 from auth.permissions import AdministerOrganizationPermission, OrganizationMemberPermission
 from auth.auth_context import get_authenticated_user
 from data import model
@@ -16,13 +16,11 @@ def robot_view(name, token):
 @resource('/v1/user/robots')
 class UserRobotList(ApiResource):
   """ Resource for listing user robots. """
+  @require_user_admin
   @nickname('getUserRobots')
   def get(self):
     """ List the available robots for the user. """
     user = get_authenticated_user()
-    if not user:
-      raise Unauthorized()
-
     robots = model.list_entity_robots(user.username)
     return {
       'robots': [robot_view(name, password) for name, password in robots]
@@ -32,24 +30,20 @@ class UserRobotList(ApiResource):
 @resource('/v1/user/robots/<robot_shortname>')
 class UserRobot(ApiResource):
   """ Resource for managing a user's robots. """
+  @require_user_admin
   @nickname('createUserRobot')
   def put(self, robot_shortname):
     """ Create a new user robot with the specified name. """
     parent = get_authenticated_user()
-    if not parent:
-      raise Unauthorized()
-
     robot, password = model.create_robot(robot_shortname, parent)
     log_action('create_robot', parent.username, {'robot': robot_shortname})
     return robot_view(robot.username, password), 201
 
+  @require_user_admin
   @nickname('deleteUserRobot')
   def delete(self, robot_shortname):
     """ Delete an existing robot. """
     parent = get_authenticated_user()
-    if not parent:
-      raise Unauthorized()
-
     model.delete_robot(format_robot_username(parent.username, robot_shortname))
     log_action('delete_robot', parent.username, {'robot': robot_shortname})
     return 'Deleted', 204