AaronPo/the-biergarten-app
1
0
Fork 0
mirror of https://github.com/aaronpo97/the-biergarten-app.git synced 2026-10-14 17:54:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Features/public biography endpoint (#316)

Browse Source
This commit is contained in:
Aaron Po
2026-09-26 19:51:10 -04:00
committed by GitHub
parent e1b6cba1d4
commit c5972b9f04
20 changed files with 158 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
web/backend/API/API.Specs/Features/PublicUserProfile.feature
View File

@@ -12,6 +12,7 @@ Scenario: Public profile exposes only allowlisted fields
When I retrieve the public profile by ID
Then the response has HTTP status 200
And the public profile response should match the registered account
And the response JSON should have "biography" equal ""
And the response JSON should not contain "email"
And the response JSON should not contain "dateOfBirth"
@@ -36,8 +37,8 @@ Scenario: A different user can read someone else's public profile
And the response JSON should not contain "email"
And the response JSON should not contain "dateOfBirth"
Scenario: Fetching a user account by ID without authentication is rejected
When I retrieve the user account by a non-existent ID without authentication
Scenario: Fetching my own account without authentication is rejected
When I retrieve my own account without authentication
Then the response has HTTP status 401
Scenario: Listing user accounts without authentication is rejected
@@ -52,15 +53,16 @@ Scenario: Listing user accounts as an authenticated user excludes private fields
And the response JSON should not contain "email"
And the response JSON should not contain "dateOfBirth"
Scenario: The owner can fetch their own account by ID
Scenario: The caller can fetch their own account
Given I have registered a new account
And I have a valid access token for my account
When I retrieve the registered account by ID
When I retrieve my own account
Then the response has HTTP status 200
And the public profile response should match the registered account
Scenario: A different user cannot fetch someone else's account by ID
Scenario: The account endpoint serves the caller named by the access token
Given I have registered a new account
And I am logged in as a different user
When I retrieve the registered account by ID
Then the response has HTTP status 403
When I retrieve my own account
Then the response has HTTP status 200
And the account response should be for a different account than the registered one

24
web/backend/API/API.Specs/Steps/UserSteps.cs
View File

@@ -54,10 +54,10 @@ public class UserSteps(ScenarioContext scenario) : ApiStepsBase(scenario)
await SendAsync(NewAuthenticatedRequest(HttpMethod.Get, $"/api/user/{Guid.NewGuid()}/profile"));
}
[When("I retrieve the user account by a non-existent ID without authentication")]
public async Task WhenIRetrieveTheUserAccountByANonExistentIdWithoutAuthentication()
[When("I retrieve my own account without authentication")]
public async Task WhenIRetrieveMyOwnAccountWithoutAuthentication()
{
await SendAsync(new HttpRequestMessage(HttpMethod.Get, $"/api/user/{Guid.NewGuid()}"));
await SendAsync(new HttpRequestMessage(HttpMethod.Get, "/api/user/authenticated"));
}
[When("I list user accounts without authentication")]
@@ -72,10 +72,10 @@ public class UserSteps(ScenarioContext scenario) : ApiStepsBase(scenario)
await SendAsync(NewAuthenticatedRequest(HttpMethod.Get, "/api/user"));
}
[When("I retrieve the registered account by ID")]
public async Task WhenIRetrieveTheRegisteredAccountById()
[When("I retrieve my own account")]
public async Task WhenIRetrieveMyOwnAccount()
{
await SendAsync(NewAuthenticatedRequest(HttpMethod.Get, $"/api/user/{GetRegisteredUserId()}"));
await SendAsync(NewAuthenticatedRequest(HttpMethod.Get, "/api/user/authenticated"));
}
[Then("the public profile response should match the registered account")]
@@ -92,4 +92,16 @@ public class UserSteps(ScenarioContext scenario) : ApiStepsBase(scenario)
root.GetProperty("userAccountId").GetGuid().Should().Be(GetRegisteredUserId());
root.GetProperty("username").GetString().Should().Be(username);
}
[Then("the account response should be for a different account than the registered one")]
public void ThenTheAccountResponseShouldBeForADifferentAccountThanTheRegisteredOne()
{
Scenario.TryGetValue<string>(ResponseBodyKey, out string? responseBody).Should().BeTrue();
using JsonDocument doc = JsonDocument.Parse(responseBody!);
doc.RootElement.GetProperty("userAccountId")
.GetGuid()
.Should()
.NotBe(GetRegisteredUserId());
}
}