Add authenticated user profile page with locked-down account endpoint (#315)

web/backend/Features/Features.Users/Queries/GetUserById/GetUserByIdHandler.cs

@@ -8,12 +8,18 @@ namespace Features.Users.Queries.GetUserById;
 public class GetUserByIdHandler(IUserListRepository repository)
     : IRequestHandler<GetUserByIdQuery, UserAccount>
 {
+    /// <exception cref="ForbiddenException">
+    /// Thrown when the caller requests an account other than their own.
+    /// </exception>
     /// <exception cref="NotFoundException">Thrown when no user account exists with the given ID.</exception>
     public async Task<UserAccount> Handle(
         GetUserByIdQuery request,
         CancellationToken cancellationToken
     )
     {
+        if (request.UserAccountId != request.RequestingUserId)
+            throw new ForbiddenException("You are not authorized to view this account.");
+
         UserAccount? user = await repository.GetByIdAsync(request.UserAccountId);
         if (user is null)
             throw new NotFoundException($"User with ID {request.UserAccountId} not found");

web/backend/Features/Features.Users/Queries/GetUserById/GetUserByIdQuery.cs

@@ -3,4 +3,9 @@ using MediatR;
 
 namespace Features.Users.Queries.GetUserById;
 
-public record GetUserByIdQuery(Guid UserAccountId) : IRequest<UserAccount>;
+/// <param name="UserAccountId">The account to fetch.</param>
+/// <param name="RequestingUserId">
+/// The authenticated caller's ID, from the access token. It must equal
+/// <paramref name="UserAccountId" />. This query returns private fields, including <c>Email</c>.
+/// </param>
+public record GetUserByIdQuery(Guid UserAccountId, Guid RequestingUserId) : IRequest<UserAccount>;