Add authenticated user profile page with locked-down account endpoint (#315)

web/backend/Features/Features.Users.Tests/Queries/GetAllUsersHandlerTests.cs

@@ -1,4 +1,5 @@
 using Domain.Entities;
+using Features.Users.Dtos;
 using Features.Users.Queries.GetAllUsers;
 using Features.Users.Repository;
 using FluentAssertions;
@@ -15,7 +16,7 @@ public class GetAllUsersHandlerTests
         GetAllUsersHandler handler = new(repoMock.Object);
         repoMock.Setup(r => r.GetAllAsync(10, 5)).ReturnsAsync(Array.Empty<UserAccount>());
 
-        IEnumerable<UserAccount> result = await handler.Handle(
+        IEnumerable<PublicUserProfileDto> result = await handler.Handle(
             new GetAllUsersQuery(10, 5),
             CancellationToken.None
         );
@@ -23,4 +24,27 @@ public class GetAllUsersHandlerTests
         result.Should().BeEmpty();
         repoMock.Verify(r => r.GetAllAsync(10, 5), Times.Once);
     }
+
+    [Fact]
+    public async Task Handle_MapsUsersToPublicProfileDtos_AndExcludesPrivateFields()
+    {
+        Mock<IUserListRepository> repoMock = new();
+        GetAllUsersHandler handler = new(repoMock.Object);
+        UserAccount user = new()
+        {
+            UserAccountId = Guid.NewGuid(),
+            Username = "someone",
+            FirstName = "Some",
+            LastName = "One",
+            CreatedAt = DateTime.UtcNow,
+        };
+        repoMock.Setup(r => r.GetAllAsync(null, null)).ReturnsAsync([user]);
+
+        IEnumerable<PublicUserProfileDto> result = await handler.Handle(
+            new GetAllUsersQuery(null, null),
+            CancellationToken.None
+        );
+
+        result.Should().ContainSingle().Which.Should().BeEquivalentTo(user.ToPublicProfileDto());
+    }
 }

web/backend/Features/Features.Users.Tests/Queries/GetPublicUserProfileByIdHandlerTests.cs

@@ -0,0 +1,65 @@
+using Domain.Entities;
+using Domain.Exceptions;
+using Features.Users.Dtos;
+using Features.Users.Queries.GetPublicUserProfileById;
+using Features.Users.Repository;
+using FluentAssertions;
+using Moq;
+
+namespace Features.Users.Tests.Queries;
+
+public class GetPublicUserProfileByIdHandlerTests
+{
+    private readonly GetPublicUserProfileByIdHandler _handler;
+    private readonly Mock<IUserListRepository> _repoMock = new();
+
+    public GetPublicUserProfileByIdHandlerTests()
+    {
+        _handler = new GetPublicUserProfileByIdHandler(_repoMock.Object);
+    }
+
+    [Fact]
+    public async Task Handle_ReturnsPublicProfile_WhenFound()
+    {
+        UserAccount user = new()
+        {
+            UserAccountId = Guid.NewGuid(),
+            Username = "test",
+            FirstName = "Jane",
+            LastName = "Doe",
+            Email = "jane@example.com",
+            DateOfBirth = new DateTime(1990, 1, 1),
+            CreatedAt = new DateTime(2024, 1, 1),
+        };
+        _repoMock.Setup(r => r.GetByIdAsync(user.UserAccountId)).ReturnsAsync(user);
+
+        PublicUserProfileDto result = await _handler.Handle(
+            new GetPublicUserProfileByIdQuery(user.UserAccountId),
+            CancellationToken.None
+        );
+
+        result
+            .Should()
+            .Be(
+                new PublicUserProfileDto(
+                    user.UserAccountId,
+                    user.Username,
+                    user.FirstName,
+                    user.LastName,
+                    user.CreatedAt
+                )
+            );
+    }
+
+    [Fact]
+    public async Task Handle_Throws_WhenNotFound()
+    {
+        Guid id = Guid.NewGuid();
+        _repoMock.Setup(r => r.GetByIdAsync(id)).ReturnsAsync((UserAccount?)null);
+
+        Func<Task<PublicUserProfileDto>> act = async () =>
+            await _handler.Handle(new GetPublicUserProfileByIdQuery(id), CancellationToken.None);
+
+        await act.Should().ThrowAsync<NotFoundException>();
+    }
+}

web/backend/Features/Features.Users.Tests/Queries/GetUserByIdHandlerTests.cs

@@ -24,7 +24,7 @@ public class GetUserByIdHandlerTests
         _repoMock.Setup(r => r.GetByIdAsync(user.UserAccountId)).ReturnsAsync(user);
 
         UserAccount result = await _handler.Handle(
-            new GetUserByIdQuery(user.UserAccountId),
+            new GetUserByIdQuery(user.UserAccountId, user.UserAccountId),
             CancellationToken.None
         );
 
@@ -38,8 +38,21 @@ public class GetUserByIdHandlerTests
         _repoMock.Setup(r => r.GetByIdAsync(id)).ReturnsAsync((UserAccount?)null);
 
         Func<Task<UserAccount>> act = async () =>
-            await _handler.Handle(new GetUserByIdQuery(id), CancellationToken.None);
+            await _handler.Handle(new GetUserByIdQuery(id, id), CancellationToken.None);
 
         await act.Should().ThrowAsync<NotFoundException>();
     }
+
+    [Fact]
+    public async Task Handle_Throws_WhenRequestingSomeoneElsesAccount()
+    {
+        Guid id = Guid.NewGuid();
+        Guid requestingUserId = Guid.NewGuid();
+
+        Func<Task<UserAccount>> act = async () =>
+            await _handler.Handle(new GetUserByIdQuery(id, requestingUserId), CancellationToken.None);
+
+        await act.Should().ThrowAsync<ForbiddenException>();
+        _repoMock.Verify(r => r.GetByIdAsync(It.IsAny<Guid>()), Times.Never);
+    }
 }