Require username

[annehaley]

Resolves #446

[cloudflare-workers-and-pages]

Deploying geodatalytics with    Cloudflare Pages

Latest commit:	5fc7927
Status:	✅  Deploy successful!
Preview URL:	https://c29b207d.geodatalytics.pages.dev
Branch Preview URL:	https://require-usernames.geodatalytics.pages.dev

View logs

[BryonLewis]

I have some comments/questions about this PR. Mostly notes that may be require a subsequent PR.

• Just a reminder that we either need to create some sort of migration or manually make sure that all existing users that have username based on the email have it swapped to something that isn't their email, or remove all existing users.
• When doing a GET /projects there is information about the owner including the username and is_superuser, should we prevent that information from being sent during this request? This information leaks through for non-authenticated users. This may be a bigger lift because I think you would have a response with the owner/collaborator/follower information removed for unauthenticated users because they never open the access control.
• I question if the serializer should be returning is_superuser for most of the requests that contain users like project owners and user lists? Is it being used in the client anywhere? I think it's only used on the /users/me request. So access control doesn't need to leak who is a super user.
• UserFactory/SuperUserFactory in the tests still use username = email which isn't true anymore after this. Technically it doesn't matter but it would probably be a better representation if username was used.

[BryonLewis]

The #446 issue mentions showing the username as a subtitle and tooltip, this right here is showing the full first/last name as the tooltip.