Features/public biography endpoint (#316)

web/backend/Features/Features.Users/Controllers/UserController.cs

@@ -17,9 +17,10 @@ namespace Features.Users.Controllers;
 /// <remarks>
 ///     Every endpoint requires <c>[Authorize(AuthenticationSchemes = "JWT")]</c> except
 ///     <see cref="GetPublicProfile" />, which is <see cref="AllowAnonymousAttribute" /> since it
-///     only returns an allowlisted DTO. <see cref="GetById" /> also restricts access to the
-///     caller's own account. Neither <see cref="GetAll" /> nor <see cref="GetById" /> may expose
-///     another user's <c>Email</c> or <c>DateOfBirth</c>.
+///     only returns an allowlisted DTO. <see cref="GetAuthenticated" /> serves the caller's own
+///     account, taken from the access token. Neither <see cref="GetAll" /> nor
+///     <see cref="GetPublicProfile" /> may expose another user's <c>Email</c> or
+///     <c>DateOfBirth</c>.
 /// </remarks>
 [ApiController]
 [Route("api/[controller]")]
@@ -41,18 +42,15 @@ public class UserController(IMediator mediator) : ControllerBase
         return Ok(users);
     }
 
-    /// <summary>Gets the caller's own user account by ID.</summary>
-    /// <exception cref="ForbiddenException">
-    /// Thrown when <paramref name="id"/> is not the caller's own account. The API returns HTTP status 403.
-    /// </exception>
+    /// <summary>Gets the authenticated caller's own user account.</summary>
     /// <exception cref="NotFoundException">
-    /// Thrown when no user account exists with the given ID, resulting in a 404 response.
+    /// Thrown when no user account exists for the caller's ID, resulting in a 404 response.
     /// </exception>
-    [HttpGet("{id:guid}")]
-    public async Task<ActionResult<UserAccount>> GetById(Guid id)
+    [HttpGet("authenticated")]
+    public async Task<ActionResult<UserAccount>> GetAuthenticated()
     {
         UserAccount user = await mediator.Send(
-            new GetUserByIdQuery(id, User.GetAuthenticatedUserId())
+            new GetUserByIdQuery(User.GetAuthenticatedUserId())
         );
         return Ok(user);
     }
@@ -61,7 +59,7 @@ public class UserController(IMediator mediator) : ControllerBase
     /// <remarks>
     /// This endpoint is anonymous-accessible and requires no ownership. Anyone can view any
     /// account's public profile. The response includes only fields that are safe to show publicly.
-    /// Unlike <see cref="GetById"/>, it never includes <c>Email</c> or <c>DateOfBirth</c>.
+    /// Unlike <see cref="GetAuthenticated"/>, it never includes <c>Email</c> or <c>DateOfBirth</c>.
     /// </remarks>
     /// <exception cref="NotFoundException">
     /// Thrown when no user account exists with the given ID. The API returns HTTP status 404.

web/backend/Features/Features.Users/Dtos/UserDtoMapper.cs

@@ -6,6 +6,15 @@ namespace Features.Users.Dtos;
 public static class UserDtoMapper
 {
     /// <summary>Converts a user account into its public-profile representation.</summary>
-    public static PublicUserProfileDto ToPublicProfileDto(this UserAccount user) =>
-        new(user.UserAccountId, user.Username, user.FirstName, user.LastName, user.CreatedAt);
+    public static PublicUserProfileDto ToPublicProfileDto(this UserAccount user)
+    {
+        return new PublicUserProfileDto(
+            UserAccountId : user.UserAccountId,
+            Username : user.Username,
+            FirstName : user.FirstName,
+            LastName : user.LastName,
+            Biography : user.UserProfile?.Biography ?? string.Empty,
+            CreatedAt : user.CreatedAt
+        );
+    }
 }

web/backend/Features/Features.Users/Dtos/UserDtos.cs

@@ -6,5 +6,6 @@ public record PublicUserProfileDto(
     string Username,
     string FirstName,
     string LastName,
+    string Biography,
     DateTime CreatedAt
 );

web/backend/Features/Features.Users/Queries/GetUserById/GetUserByIdHandler.cs

@@ -8,18 +8,12 @@ namespace Features.Users.Queries.GetUserById;
 public class GetUserByIdHandler(IUserListRepository repository)
     : IRequestHandler<GetUserByIdQuery, UserAccount>
 {
-    /// <exception cref="ForbiddenException">
-    /// Thrown when the caller requests an account other than their own.
-    /// </exception>
     /// <exception cref="NotFoundException">Thrown when no user account exists with the given ID.</exception>
     public async Task<UserAccount> Handle(
         GetUserByIdQuery request,
         CancellationToken cancellationToken
     )
     {
-        if (request.UserAccountId != request.RequestingUserId)
-            throw new ForbiddenException("You are not authorized to view this account.");
-
         UserAccount? user = await repository.GetByIdAsync(request.UserAccountId);
         if (user is null)
             throw new NotFoundException($"User with ID {request.UserAccountId} not found");

web/backend/Features/Features.Users/Queries/GetUserById/GetUserByIdQuery.cs

@@ -3,9 +3,7 @@ using MediatR;
 
 namespace Features.Users.Queries.GetUserById;
 
-/// <param name="UserAccountId">The account to fetch.</param>
-/// <param name="RequestingUserId">
-/// The authenticated caller's ID, from the access token. It must equal
-/// <paramref name="UserAccountId" />. This query returns private fields, including <c>Email</c>.
+/// <param name="UserAccountId">
+/// The account to fetch. This query returns private fields, including <c>Email</c>.
 /// </param>
-public record GetUserByIdQuery(Guid UserAccountId, Guid RequestingUserId) : IRequest<UserAccount>;
+public record GetUserByIdQuery(Guid UserAccountId) : IRequest<UserAccount>;

web/backend/Features/Features.Users/Repository/UserListRepository.cs

@@ -13,20 +13,41 @@ public class UserListRepository(ISqlConnectionFactory connectionFactory)
         IUserListRepository
 {
     /// <inheritdoc />
+    /// <remarks>
+    ///     Left-joins <c>Social.UserProfile</c>, so <see cref="UserAccount.UserProfile" /> is
+    ///     <c>null</c> for an account whose profile has yet to be created.
+    /// </remarks>
     public async Task<UserAccount?> GetByIdAsync(Guid id)
     {
         await using DbConnection connection = await CreateConnection();
-        return await connection.QueryFirstOrDefaultAsync<UserAccount>(
+        IEnumerable<UserAccount> results = await connection.QueryAsync<
+            UserAccount,
+            UserProfile,
+            UserAccount
+        >(
             """
             SELECT 
-                UserAccountID, 
-                Username, 
-                FirstName, LastName, Email, CreatedAt, UpdatedAt, DateOfBirth, RowVersion
-            FROM Auth.UserAccount
-            WHERE UserAccountID = @UserAccountId
+                ua.UserAccountID, 
+                ua.Username, 
+                ua.FirstName, ua.LastName, ua.Email, ua.CreatedAt, ua.UpdatedAt,
+                ua.DateOfBirth, ua.RowVersion,
+                up.UserProfileID, up.UserAccountID, up.Biography, up.RowVersion
+            FROM Auth.UserAccount ua
+            LEFT JOIN Social.UserProfile up ON ua.UserAccountID = up.UserAccountID
+            WHERE ua.UserAccountID = @UserAccountId
             """,
-            new { UserAccountId = id }
+            MapUserRow,
+            new { UserAccountId = id },
+            splitOn: "UserProfileID"
         );
+
+        return results.SingleOrDefault();
+    }
+
+    private static UserAccount MapUserRow(UserAccount user, UserProfile? profile)
+    {
+        user.UserProfile = profile;
+        return user;
     }
 
     /// <inheritdoc />