Repository: cookiecutter/cookiecutter-django

Issue:
What is the purpose of exposing the list of users?
## Description
The `users` app provides a view to list all the users.

https://github.com/pydanny/cookiecutter-django/blob/28160d06ac15635a3596db53bf53493bc252f141/%7B%7Bcookiecutter.project_slug%7D%7D/%7B%7Bcookiecutter.project_slug%7D%7D/users/urls.py#L12

Probably I am missing something obvious, but is this necessary? Why would a user be able to view all the registered users of the web service? At first I thought this would be only accessible in local environment, but I couldn't find a setting which prevents it from showing up the production environment.



Discussion:
I'd say, our `users` is pretty much a placeholder app: it's not intended to be rolled out to production as-is, and I'm sure no one would seriously consider doing so. For what it's worth, you're right, it's no good practice. Maybe you could send a PR fixing this?
Even though I agree, it is possible that one misses that configuration, especially before becoming familiar with the complete structure of the project. In my opinion, it would be best to keep this only in the local/development environment, so that one would have to intentionally enable it in order to appear in the production. Yes I can send a PR, but first I have to figure out how it is best to implement this.
@demestav we can just remove that route.
@webyneter Well the `user detail` also "exposes" other users' details if the username is known. Therefore, in the context of this issue, that should be removed too. What do you think about exposing the `user` app urls only when `DEBUG=True`?
Got no problem with that.
For what it's worth I always thought this was a bit weird too, so good suggestion to put make it local only (or even better just remove it). 
@yunti In https://github.com/pydanny/cookiecutter-django/pull/1761 (still pending review) the `users` app is only exposed when `DEBUG` is `True` so the developer is free to explore it, and at the same time, prevent exposure of the users in production by accident.

Resolving patch:
diff --git a/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/urls.py b/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/urls.py
--- a/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/urls.py
+++ b/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/urls.py
@@ -1,7 +1,6 @@
 from django.urls import path
 
 from {{ cookiecutter.project_slug }}.users.views import (
-    user_list_view,
     user_redirect_view,
     user_update_view,
     user_detail_view,
@@ -9,7 +8,6 @@
 
 app_name = "users"
 urlpatterns = [
-    path("", view=user_list_view, name="list"),
     path("~redirect/", view=user_redirect_view, name="redirect"),
     path("~update/", view=user_update_view, name="update"),
     path("<str:username>/", view=user_detail_view, name="detail"),
diff --git a/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/views.py b/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/views.py
--- a/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/views.py
+++ b/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/views.py
@@ -1,7 +1,7 @@
 from django.contrib.auth import get_user_model
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.urls import reverse
-from django.views.generic import DetailView, ListView, RedirectView, UpdateView
+from django.views.generic import DetailView, RedirectView, UpdateView
 
 User = get_user_model()
 
@@ -16,16 +16,6 @@ class UserDetailView(LoginRequiredMixin, DetailView):
 user_detail_view = UserDetailView.as_view()
 
 
-class UserListView(LoginRequiredMixin, ListView):
-
-    model = User
-    slug_field = "username"
-    slug_url_kwarg = "username"
-
-
-user_list_view = UserListView.as_view()
-
-
 class UserUpdateView(LoginRequiredMixin, UpdateView):
 
     model = User


Test patch:
diff --git a/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/tests/test_urls.py b/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/tests/test_urls.py
--- a/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/tests/test_urls.py
+++ b/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/tests/test_urls.py
@@ -13,11 +13,6 @@ def test_detail(user: settings.AUTH_USER_MODEL):
     assert resolve(f"/users/{user.username}/").view_name == "users:detail"
 
 
-def test_list():
-    assert reverse("users:list") == "/users/"
-    assert resolve("/users/").view_name == "users:list"
-
-
 def test_update():
     assert reverse("users:update") == "/users/~update/"
     assert resolve("/users/~update/").view_name == "users:update"