src/authentic2/api_views.py

@@ -717,6 +717,9 @@ class UsersAPIPagination(pagination.CursorPagination):
     page_size_query_param = 'limit'
     max_page_size = 100
 
+    def __init__(self):
+        self.offset_cutoff = app_settings.A2_API_USERS_NUMBER_LIMIT
+
 
 class UsersAPI(api_mixins.GetOrCreateMixinView, HookMixin, ExceptionHandlerMixin, ModelViewSet):
     queryset = User.objects.all()

src/authentic2/app_settings.py

@@ -314,6 +314,10 @@ default_settings = dict(
         default=250,
         definition='Maximum number of mails to send per period',
     ),
+    A2_API_USERS_NUMBER_LIMIT=Setting(
+        default=1000,
+        definition='Maximum number of users returned by REST API',
+    ),
 )
 
 app_settings = AppSettings(default_settings)

tests/api/test_all.py

@@ -21,11 +21,13 @@ import random
 import uuid
 from unittest import mock
 
+import faker
 import pytest
 from django.contrib.auth import get_user_model
 from django.contrib.auth.hashers import check_password
 from django.contrib.contenttypes.models import ContentType
 from django.core import mail
+from django.test.utils import override_settings
 from django.urls import reverse
 from django.utils.encoding import force_str
 from django.utils.text import slugify
@@ -235,6 +237,21 @@ def test_api_users_list(app, user):
         assert resp.json['results'][0]['full_name']
 
 
+def test_api_users_list_limit(app, superuser):
+    app.authorization = ('Basic', (superuser.username, superuser.username))
+    for i in range(0, 201):
+        User.objects.create(first_name='User%s' % i, email=faker.Faker().email())
+    resp = app.get('/api/users/')
+    assert resp.json['next']
+    next_url = resp.json['next']
+
+    with override_settings(A2_API_USERS_NUMBER_LIMIT=200):
+        resp = app.get(next_url)
+        next_url = resp.json['next']
+        # when users number limit is reached DRF returns same next url
+        assert next_url == resp.json['next']
+
+
 def test_api_member_users_list(app, user, simple_role):
     app.authorization = ('Basic', (user.username, user.username))
     url = reverse('a2-api-role-members-list', kwargs={'role_uuid': simple_role.uuid})