4: Authenticated Services and Security with JWTs

Activity 7: Implementing Access Control on the publish/unpublish Recipe Function

Solution

1. Modify the put method in RecipePublishResource to restrict access to only authenticated users. In resources/token.py, add the @jwt_required decorator on top of the RecipePublishResource.put method. Use the get_jwt_identity() function to identify whether the authenticated user is the owner of the recipe:

       @jwt_required
       def put(self, recipe_id):
           recipe = Recipe.get_by_id(recipe_id=recipe_id)
           if recipe is None:
               return {'message': 'Recipe not found'}, HTTPStatus.NOT_FOUND
           current_user = get_jwt_identity()
           if current_user...