AaronPo/the-biergarten-app
1
0
Fork 0
mirror of https://github.com/aaronpo97/the-biergarten-app.git synced 2026-10-14 17:54:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add authenticated user profile page with locked-down account endpoint (#315)

Browse Source
This commit is contained in:
Aaron Po
2026-09-23 00:58:54 -04:00
committed by GitHub
parent a6a9046457
commit 0ff42c3c70
45 changed files with 1418 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
web/backend/API/API.Specs/Features/PublicUserProfile.feature Normal file
View File

@@ -0,0 +1,66 @@
Feature: Public User Profile
As a client of the API
I want to read a user's public-facing profile
So that a public profile page can render without exposing private account fields
Background:
Given the API is running
Scenario: Public profile exposes only allowlisted fields
Given I have registered a new account
And I have a valid access token for my account
When I retrieve the public profile by ID
Then the response has HTTP status 200
And the public profile response should match the registered account
And the response JSON should not contain "email"
And the response JSON should not contain "dateOfBirth"
Scenario: Public profile for a non-existent account returns not found
Given I have registered a new account
And I have a valid access token for my account
When I retrieve the public profile by a non-existent ID
Then the response has HTTP status 404
Scenario: Fetching the public profile without authentication succeeds
Given I have registered a new account
When I retrieve the public profile by ID without authentication
Then the response has HTTP status 200
And the response JSON should not contain "email"
And the response JSON should not contain "dateOfBirth"
Scenario: A different user can read someone else's public profile
Given I have registered a new account
And I am logged in as a different user
When I retrieve the public profile by ID
Then the response has HTTP status 200
And the response JSON should not contain "email"
And the response JSON should not contain "dateOfBirth"
Scenario: Fetching a user account by ID without authentication is rejected
When I retrieve the user account by a non-existent ID without authentication
Then the response has HTTP status 401
Scenario: Listing user accounts without authentication is rejected
When I list user accounts without authentication
Then the response has HTTP status 401
Scenario: Listing user accounts as an authenticated user excludes private fields
Given I have registered a new account
And I have a valid access token for my account
When I list user accounts
Then the response has HTTP status 200
And the response JSON should not contain "email"
And the response JSON should not contain "dateOfBirth"
Scenario: The owner can fetch their own account by ID
Given I have registered a new account
And I have a valid access token for my account
When I retrieve the registered account by ID
Then the response has HTTP status 200
And the public profile response should match the registered account
Scenario: A different user cannot fetch someone else's account by ID
Given I have registered a new account
And I am logged in as a different user
When I retrieve the registered account by ID
Then the response has HTTP status 403