feat: allow limiting the use of LNbits to some user uuids

The `LNBITS_ALLOWED_USERS` env var can be used to limit access
to the application to some uuids only. "all" gives open access.
UUIDs should be comma separated.

lnbits/core/views/generic.py

@@ -1,6 +1,6 @@
 from flask import g, abort, redirect, request, render_template, send_from_directory, url_for
 from http import HTTPStatus
-from os import path
+from os import getenv, path
 
 from lnbits.core import core_app
 from lnbits.decorators import check_user_exists, validate_uuids
@@ -61,6 +61,10 @@ def wallet():
         user = get_user(create_account().id)
     else:
         user = get_user(user_id) or abort(HTTPStatus.NOT_FOUND, "User does not exist.")
+        allowed_users = getenv("LNBITS_ALLOWED_USERS", "all")
+
+        if allowed_users != "all" and user_id not in allowed_users.split(","):
+            abort(HTTPStatus.UNAUTHORIZED, f"User not authorized.")
 
     if not wallet_id:
         if user.wallets and not wallet_name: