Add authenticated user profile page with locked-down account endpoint (#315)

web/backend/Features/Features.Users/Controllers/UserController.cs

@@ -1,40 +1,76 @@
 using Domain.Entities;
 using Domain.Exceptions;
+using Features.Users.Dtos;
 using Features.Users.Queries.GetAllUsers;
+using Features.Users.Queries.GetPublicUserProfileById;
 using Features.Users.Queries.GetUserById;
 using MediatR;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Shared.Contracts;
 
 namespace Features.Users.Controllers;
 
 /// <summary>
 ///     Exposes read endpoints for user accounts.
 /// </summary>
+/// <remarks>
+///     Every endpoint requires <c>[Authorize(AuthenticationSchemes = "JWT")]</c> except
+///     <see cref="GetPublicProfile" />, which is <see cref="AllowAnonymousAttribute" /> since it
+///     only returns an allowlisted DTO. <see cref="GetById" /> also restricts access to the
+///     caller's own account. Neither <see cref="GetAll" /> nor <see cref="GetById" /> may expose
+///     another user's <c>Email</c> or <c>DateOfBirth</c>.
+/// </remarks>
 [ApiController]
 [Route("api/[controller]")]
+[Authorize(AuthenticationSchemes = "JWT")]
 public class UserController(IMediator mediator) : ControllerBase
 {
-    /// <summary>Gets a page of user accounts, ordered by creation date descending.</summary>
+    /// <summary>Gets a page of user accounts' public profiles, ordered by creation date descending.</summary>
     /// <param name="limit"><c>null</c> for no limit.</param>
     /// <param name="offset"><c>null</c> for no offset.</param>
     [HttpGet]
-    public async Task<ActionResult<IEnumerable<UserAccount>>> GetAll(
+    public async Task<ActionResult<IEnumerable<PublicUserProfileDto>>> GetAll(
         [FromQuery] int? limit,
         [FromQuery] int? offset
     )
     {
-        IEnumerable<UserAccount> users = await mediator.Send(new GetAllUsersQuery(limit, offset));
+        IEnumerable<PublicUserProfileDto> users = await mediator.Send(
+            new GetAllUsersQuery(limit, offset)
+        );
         return Ok(users);
     }
 
-    /// <summary>Gets the user account with the given ID.</summary>
+    /// <summary>Gets the caller's own user account by ID.</summary>
+    /// <exception cref="ForbiddenException">
+    /// Thrown when <paramref name="id"/> is not the caller's own account. The API returns HTTP status 403.
+    /// </exception>
     /// <exception cref="NotFoundException">
     /// Thrown when no user account exists with the given ID, resulting in a 404 response.
     /// </exception>
     [HttpGet("{id:guid}")]
     public async Task<ActionResult<UserAccount>> GetById(Guid id)
     {
-        UserAccount user = await mediator.Send(new GetUserByIdQuery(id));
+        UserAccount user = await mediator.Send(
+            new GetUserByIdQuery(id, User.GetAuthenticatedUserId())
+        );
         return Ok(user);
     }
+
+    /// <summary>Gets the public profile for the user account with the given ID.</summary>
+    /// <remarks>
+    /// This endpoint is anonymous-accessible and requires no ownership. Anyone can view any
+    /// account's public profile. The response includes only fields that are safe to show publicly.
+    /// Unlike <see cref="GetById"/>, it never includes <c>Email</c> or <c>DateOfBirth</c>.
+    /// </remarks>
+    /// <exception cref="NotFoundException">
+    /// Thrown when no user account exists with the given ID. The API returns HTTP status 404.
+    /// </exception>
+    [HttpGet("{id:guid}/profile")]
+    [AllowAnonymous]
+    public async Task<ActionResult<PublicUserProfileDto>> GetPublicProfile(Guid id)
+    {
+        PublicUserProfileDto profile = await mediator.Send(new GetPublicUserProfileByIdQuery(id));
+        return Ok(profile);
+    }
 }

web/backend/Features/Features.Users/Dtos/UserDtoMapper.cs

@@ -0,0 +1,11 @@
+using Domain.Entities;
+
+namespace Features.Users.Dtos;
+
+/// <summary>Converts user domain entities into API response models.</summary>
+public static class UserDtoMapper
+{
+    /// <summary>Converts a user account into its public-profile representation.</summary>
+    public static PublicUserProfileDto ToPublicProfileDto(this UserAccount user) =>
+        new(user.UserAccountId, user.Username, user.FirstName, user.LastName, user.CreatedAt);
+}

web/backend/Features/Features.Users/Dtos/UserDtos.cs

@@ -0,0 +1,10 @@
+namespace Features.Users.Dtos;
+
+/// <summary>Represents the subset of a user account that is safe to expose on a public profile.</summary>
+public record PublicUserProfileDto(
+    Guid UserAccountId,
+    string Username,
+    string FirstName,
+    string LastName,
+    DateTime CreatedAt
+);

web/backend/Features/Features.Users/Queries/GetAllUsers/GetAllUsersHandler.cs

@@ -1,17 +1,19 @@
 using Domain.Entities;
+using Features.Users.Dtos;
 using Features.Users.Repository;
 using MediatR;
 
 namespace Features.Users.Queries.GetAllUsers;
 
 public class GetAllUsersHandler(IUserListRepository repository)
-    : IRequestHandler<GetAllUsersQuery, IEnumerable<UserAccount>>
+    : IRequestHandler<GetAllUsersQuery, IEnumerable<PublicUserProfileDto>>
 {
-    public Task<IEnumerable<UserAccount>> Handle(
+    public async Task<IEnumerable<PublicUserProfileDto>> Handle(
         GetAllUsersQuery request,
         CancellationToken cancellationToken
     )
     {
-        return repository.GetAllAsync(request.Limit, request.Offset);
+        IEnumerable<UserAccount> users = await repository.GetAllAsync(request.Limit, request.Offset);
+        return users.Select(user => user.ToPublicProfileDto());
     }
 }

web/backend/Features/Features.Users/Queries/GetAllUsers/GetAllUsersQuery.cs

@@ -1,11 +1,11 @@
-using Domain.Entities;
+using Features.Users.Dtos;
 using MediatR;
 
 namespace Features.Users.Queries.GetAllUsers;
 
 /// <summary>
-///     Requests a page of user accounts, ordered by creation date descending.
+///     Requests a page of user accounts' public profiles, ordered by creation date descending.
 /// </summary>
 /// <param name="Limit"><c>null</c> for no limit.</param>
 /// <param name="Offset"><c>null</c> for no offset.</param>
-public record GetAllUsersQuery(int? Limit, int? Offset) : IRequest<IEnumerable<UserAccount>>;
+public record GetAllUsersQuery(int? Limit, int? Offset) : IRequest<IEnumerable<PublicUserProfileDto>>;

web/backend/Features/Features.Users/Queries/GetPublicUserProfileById/GetPublicUserProfileByIdHandler.cs

@@ -0,0 +1,23 @@
+using Domain.Entities;
+using Domain.Exceptions;
+using Features.Users.Dtos;
+using Features.Users.Repository;
+using MediatR;
+
+namespace Features.Users.Queries.GetPublicUserProfileById;
+
+public class GetPublicUserProfileByIdHandler(IUserListRepository repository)
+    : IRequestHandler<GetPublicUserProfileByIdQuery, PublicUserProfileDto>
+{
+    /// <exception cref="NotFoundException">Thrown when no user account exists with the given ID.</exception>
+    public async Task<PublicUserProfileDto> Handle(
+        GetPublicUserProfileByIdQuery request,
+        CancellationToken cancellationToken
+    )
+    {
+        UserAccount? user = await repository.GetByIdAsync(request.UserAccountId);
+        if (user is null)
+            throw new NotFoundException($"User with ID {request.UserAccountId} not found");
+        return user.ToPublicProfileDto();
+    }
+}

web/backend/Features/Features.Users/Queries/GetPublicUserProfileById/GetPublicUserProfileByIdQuery.cs

@@ -0,0 +1,6 @@
+using Features.Users.Dtos;
+using MediatR;
+
+namespace Features.Users.Queries.GetPublicUserProfileById;
+
+public record GetPublicUserProfileByIdQuery(Guid UserAccountId) : IRequest<PublicUserProfileDto>;

web/backend/Features/Features.Users/Queries/GetUserById/GetUserByIdHandler.cs

@@ -8,12 +8,18 @@ namespace Features.Users.Queries.GetUserById;
 public class GetUserByIdHandler(IUserListRepository repository)
     : IRequestHandler<GetUserByIdQuery, UserAccount>
 {
+    /// <exception cref="ForbiddenException">
+    /// Thrown when the caller requests an account other than their own.
+    /// </exception>
     /// <exception cref="NotFoundException">Thrown when no user account exists with the given ID.</exception>
     public async Task<UserAccount> Handle(
         GetUserByIdQuery request,
         CancellationToken cancellationToken
     )
     {
+        if (request.UserAccountId != request.RequestingUserId)
+            throw new ForbiddenException("You are not authorized to view this account.");
+
         UserAccount? user = await repository.GetByIdAsync(request.UserAccountId);
         if (user is null)
             throw new NotFoundException($"User with ID {request.UserAccountId} not found");

web/backend/Features/Features.Users/Queries/GetUserById/GetUserByIdQuery.cs

@@ -3,4 +3,9 @@ using MediatR;
 
 namespace Features.Users.Queries.GetUserById;
 
-public record GetUserByIdQuery(Guid UserAccountId) : IRequest<UserAccount>;
+/// <param name="UserAccountId">The account to fetch.</param>
+/// <param name="RequestingUserId">
+/// The authenticated caller's ID, from the access token. It must equal
+/// <paramref name="UserAccountId" />. This query returns private fields, including <c>Email</c>.
+/// </param>
+public record GetUserByIdQuery(Guid UserAccountId, Guid RequestingUserId) : IRequest<UserAccount>;

web/backend/Features/Features.Users/Repository/UserListRepository.cs

@@ -33,13 +33,15 @@ public class UserListRepository(ISqlConnectionFactory connectionFactory)
     /// <remarks>
     ///     Always applies pagination via <c>OFFSET</c>/<c>FETCH</c>, ordered by creation date descending.
     ///     A <c>null</c> <paramref name="limit" />/<paramref name="offset" /> is treated as "no limit"/"no offset".
+    ///     Does not select <c>Email</c> or <c>DateOfBirth</c>: this listing is consumed only as public
+    ///     profiles, so those fields are left at their default rather than read from the database.
     /// </remarks>
     public async Task<IEnumerable<UserAccount>> GetAllAsync(int? limit, int? offset)
     {
         await using DbConnection connection = await CreateConnection();
         return await connection.QueryAsync<UserAccount>(
             """
-            SELECT UserAccountID, Username, FirstName, LastName, Email, CreatedAt, UpdatedAt, DateOfBirth, RowVersion
+            SELECT UserAccountID, Username, FirstName, LastName, CreatedAt, UpdatedAt, RowVersion
             FROM Auth.UserAccount
             ORDER BY CreatedAt DESC
             OFFSET @Offset ROWS FETCH NEXT @Limit ROWS ONLY