Allow parameter 'external' for normal users

lib/api/users.rb

@@ -98,7 +98,7 @@ module API
       end
       # rubocop: disable CodeReuse/ActiveRecord
       get feature_category: :users do
-        authenticated_as_admin! if params[:external].present? || (params[:extern_uid].present? && params[:provider].present?)
+        authenticated_as_admin! if params[:extern_uid].present? && params[:provider].present?
 
         unless current_user&.admin?
           params.except!(:created_after, :created_before, :order_by, :sort, :two_factor, :without_projects)

spec/finders/users_finder_spec.rb

@@ -51,6 +51,12 @@ RSpec.describe UsersFinder do
         expect(users).to contain_exactly(user, normal_user, external_user, omniauth_user, admin_user)
       end
 
+      it 'filters by external users' do
+        users = described_class.new(user, external: true).execute
+
+        expect(users).to contain_exactly(external_user)
+      end
+
       it 'filters by non external users' do
         users = described_class.new(user, non_external: true).execute
 

spec/requests/api/users_spec.rb

@@ -320,6 +320,18 @@ RSpec.describe API::Users do
         expect(json_response).to all(include('state' => /(blocked|ldap_blocked)/))
       end
 
+      it "returns an array of external users" do
+        create(:user)
+        external_user = create(:user, external: true)
+
+        get api("/users?external=true", user)
+
+        expect(response).to match_response_schema('public_api/v4/user/basics')
+        expect(response).to include_pagination_headers
+        expect(json_response.size).to eq(1)
+        expect(json_response[0]['id']).to eq(external_user.id)
+      end
+
       it "returns one user" do
         get api("/users?username=#{omniauth_user.username}", user)