Pulp

bizhang and I were a bit confused about how the jwt_secret is functioning in the API. It looks like if JWT_ALLOW_SETTING_USER_SECRET is true and DEBUG is true, I can view the field in the API for users. However, if DEBUG is false, I can never view the field. And also, if JWT_ALLOW_SETTING_USER_SECRET is true, I can write to the field regardless of what DEBUG is.

I wonder if (A) we can simplify this logic by eliminating the separate code path around DEBUG. I think this is also beneficial for testing purposes. And (B) I am wondering if the behavior around being able to write jwt_secret but not view it is intentional/correct.

I think this may be a refactor task. Feel free to set the tracker as such. Marking this as a bug because I am not entirely it's not a bug and I am hoping for some feedback.