fix: return an empty user queryset if the user is unaunthenticated

program/views.py

@@ -265,12 +265,15 @@ class APIUserViewSet(
     search_fields = ["username", "first_name", "last_name", "email"]
 
     def get_queryset(self):
-        """The queryset contains all the users if the method is safe or requesting user is a
-        superuser, otherwise it only contains the requesting user."""
+        """The queryset is empty if the user is not authenticated, contains all the users if the
+        method is safe or the requesting user is a superuser, otherwise it only contains the
+        requesting user."""
 
         user = self.request.user
 
-        if self.request.method in permissions.SAFE_METHODS or user.is_superuser:
+        if not user.is_authenticated:
+            return User.objects.none()
+        elif self.request.method in permissions.SAFE_METHODS or user.is_superuser:
             return User.objects.all()
         else:
             return User.objects.filter(pk=user.id)