[BACK-2780] Add new user profiles endpoint.

auth/service/api/v1/appvalidate_test.go

@@ -44,29 +44,29 @@ var _ = Describe("App Validation", func() {
 	challenge := "challenge"
 	serverSessionToken := "serverToken"
 
-	unattestedUser := user{
+	unattestedUser := testUser{
 		UserID:              "unattested",
 		SessionToken:        "unattestedToken",
 		Details:             request.NewAuthDetails(request.MethodSessionToken, "unattested", "unattestedToken"),
 		AttestationVerified: false,
 	}
-	attestedUser := user{
+	attestedUser := testUser{
 		UserID:               "attested",
 		SessionToken:         "attestedToken",
 		Details:              request.NewAuthDetails(request.MethodSessionToken, "attested", "attestedToken"),
 		KeyID:                "YWJjZGVmYWJjZGVm",
 		AttestationVerified:  false,
 		AttestationChallenge: challenge,
 	}
-	attestedUnverifiedUser := user{
+	attestedUnverifiedUser := testUser{
 		UserID:               "attestedUnverified",
 		SessionToken:         "attestedUnverifiedToken",
 		Details:              request.NewAuthDetails(request.MethodSessionToken, "attestedUnverified", "attestedUnverified"),
 		KeyID:                "YWRzZmFkZg==",
 		AttestationVerified:  false,
 		AttestationChallenge: challenge,
 	}
-	attestedVerifiedUser := user{
+	attestedVerifiedUser := testUser{
 		UserID:               "attestedVerified",
 		SessionToken:         "attestedVerifiedToken",
 		Details:              request.NewAuthDetails(request.MethodSessionToken, "attestedVerified", "attestedVerifiedToken"),
@@ -75,7 +75,7 @@ var _ = Describe("App Validation", func() {
 		AttestationChallenge: challenge,
 		AssertionChallenge:   challenge,
 	}
-	users := []user{
+	users := []testUser{
 		unattestedUser,
 		attestedUser,
 		attestedVerifiedUser,
@@ -334,7 +334,7 @@ var _ = Describe("App Validation", func() {
 })
 
 // user is a helper user that contains relevant user information for tests.
-type user struct {
+type testUser struct {
 	UserID               string
 	SessionToken         string
 	Details              request.AuthDetails

auth/service/api/v1/permission.go

@@ -0,0 +1,116 @@
+package v1
+
+import (
+	"net/http"
+
+	"github.com/ant0ine/go-json-rest/rest"
+
+	"github.com/tidepool-org/platform/request"
+)
+
+// requireCustodian aborts with an error if the user associated w/ the
+// request doesn't have custodian access to the user with the id defined in the
+// url param targetParamUserID.
+//
+// This mimics the logic of amoeba's requireCustodian access. This means a
+// user has access to the target user if any of the following is true:
+//   - The is a service call (AuthDetails.IsService() == true)
+//   - The requester and target are the same - AuthDetails.UserID == targetParamUserID
+//   - The requester has explicit permissions to access targetParamUserID
+func (r *Router) requireCustodian(targetParamUserID string, handlerFunc rest.HandlerFunc) rest.HandlerFunc {
+	return func(res rest.ResponseWriter, req *rest.Request) {
+		if handlerFunc != nil && res != nil && req != nil {
+			targetUserID := req.PathParam(targetParamUserID)
+			responder := request.MustNewResponder(res, req)
+			ctx := req.Context()
+			details := request.GetAuthDetails(ctx)
+			if details == nil {
+				request.MustNewResponder(res, req).Error(http.StatusUnauthorized, request.ErrorUnauthenticated())
+				return
+			}
+			if details.IsService() || details.UserID() == targetUserID {
+				handlerFunc(res, req)
+				return
+			}
+			hasPerms, err := r.PermissionsClient().HasCustodianPermissions(ctx, details.UserID(), targetUserID)
+			if err != nil {
+				responder.InternalServerError(err)
+				return
+			}
+			if !hasPerms {
+				responder.Empty(http.StatusForbidden)
+				return
+			}
+			handlerFunc(res, req)
+		}
+	}
+}
+
+// requireMembership proceeds if the user with the id specified in the URL
+// paramter targetParamUserID has some association with the user in the current
+// request - the "requester". This mimics amoeba's requireMembership function.
+//
+// This proceeds if any of the following are true:
+//   - The is a service call (AuthDetails.IsService() == true)
+//   - The requester and target are the same - AuthDetails.UserID == targetParamUserID
+//   - The requester has any permissions to targetParamUserID OR targetParamUserID has permissions to the requester.
+func (r *Router) requireMembership(targetParamUserID string, handlerFunc rest.HandlerFunc) rest.HandlerFunc {
+	return func(res rest.ResponseWriter, req *rest.Request) {
+		if handlerFunc != nil && res != nil && req != nil {
+			targetUserID := req.PathParam(targetParamUserID)
+			responder := request.MustNewResponder(res, req)
+			ctx := req.Context()
+			details := request.GetAuthDetails(ctx)
+			if details == nil {
+				request.MustNewResponder(res, req).Error(http.StatusUnauthorized, request.ErrorUnauthenticated())
+				return
+			}
+			if details.IsService() || details.UserID() == targetUserID {
+				handlerFunc(res, req)
+				return
+			}
+			hasPerms, err := r.PermissionsClient().HasMembershipRelationship(ctx, details.UserID(), targetUserID)
+			if err != nil {
+				responder.InternalServerError(err)
+				return
+			}
+			if !hasPerms {
+				responder.Empty(http.StatusForbidden)
+				return
+			}
+			handlerFunc(res, req)
+		}
+	}
+}
+
+// requireWriteAccess aborts with an error if the request isn't a server request
+// or the authenticated user doesn't have access to the user id in the url param,
+// targetParamUserID
+func (r *Router) requireWriteAccess(targetParamUserID string, handlerFunc rest.HandlerFunc) rest.HandlerFunc {
+	return func(res rest.ResponseWriter, req *rest.Request) {
+		if handlerFunc != nil && res != nil && req != nil {
+			targetUserID := req.PathParam(targetParamUserID)
+			responder := request.MustNewResponder(res, req)
+			ctx := req.Context()
+			details := request.GetAuthDetails(ctx)
+			if details == nil {
+				responder.Empty(http.StatusUnauthorized)
+				return
+			}
+			if details.IsService() {
+				handlerFunc(res, req)
+				return
+			}
+			hasPerms, err := r.PermissionsClient().HasWritePermissions(ctx, details.UserID(), targetUserID)
+			if err != nil {
+				responder.InternalServerError(err)
+				return
+			}
+			if !hasPerms {
+				responder.Empty(http.StatusForbidden)
+				return
+			}
+			handlerFunc(res, req)
+		}
+	}
+}