Implement Basic User Management (Self-Service) #10

New issue

Open

opened 2025-04-22 23:40:10 +00:00 by abed.alrahman · 0 comments

abed.alrahman commented

2025-04-22 23:40:10 +00:00

Member

Ref epic: #13

Goal: Implement REST API endpoints allowing authenticated users to perform basic management tasks on their own accounts and group memberships.

Description:
This ticket should implement a set of endpoints for users to manage their own accounts: delete account, update account info (email, name, password), and join/leave groups based on the group design.

Prerequisites:

Completion of the "Design the Group/Tenant Feature" ticket.
Implementation of user registration ("Implement New User Registration in auth-service").
auth-service configured with Keycloak Admin API access.

What needs to be done:

Implement Account Deletion Endpoint:
    Create endpoint: e.g., DELETE /users/me.
    Requires user authentication (Bearer token).
    Use Keycloak Admin API to disable the authenticated user's account (enabled: false). Note: Disabling is generally safer than hard deletion.
Implement Account Update Endpoint:
    Create endpoint: e.g., PUT /users/me.
    Requires user authentication.
    Accept fields like firstName, lastName, email, password (with current password for verification).
    Use Keycloak Admin API to update user attributes.
    Email Change: If the email is updated, trigger the email verification flow for the new email address. Mark the new email as unverified until confirmed.
    Password Change: Securely handle password updates via Keycloak Admin API (often requires current password).
Implement Group Management Endpoints (Based on Design):
    View My Groups: e.g., GET /users/me/groups. Use Keycloak Admin API to retrieve groups the authenticated user is a member of.
    Leave Group: e.g., DELETE /users/me/groups/{group_id}. Use Keycloak Admin API to remove the user from the specified group.
    Join Group / Handle Invitations: Implement endpoints based on the specific join/invitation mechanism defined in the group design ticket (e.g., POST /groups/{group_id}/requests, POST /users/me/invitations/{inv_id}/accept). This may involve custom logic beyond simple Keycloak API calls if approval workflows are needed.
Permissions: Ensure the Keycloak service account used by auth-service has sufficient permissions to perform these user-specific modifications (e.g., manage-users often covers this, but review needed).
Testing: Add unit and integration tests for all new self-service endpoints.

Deliverables:

Updated auth-service source code with the new self-service user management endpoints.
Updated test suite.
Documentation for the new API endpoints.

Ref epic: [#13](https://git.cleverthis.com/clevermicro/user-management/issues/13) Goal: Implement REST API endpoints allowing authenticated users to perform basic management tasks on their own accounts and group memberships. Description: This ticket should implement a set of endpoints for users to manage their own accounts: delete account, update account info (email, name, password), and join/leave groups based on the group design. Prerequisites: Completion of the "Design the Group/Tenant Feature" ticket. Implementation of user registration ("Implement New User Registration in auth-service"). auth-service configured with Keycloak Admin API access. What needs to be done: Implement Account Deletion Endpoint: Create endpoint: e.g., DELETE /users/me. Requires user authentication (Bearer token). Use Keycloak Admin API to disable the authenticated user's account (enabled: false). Note: Disabling is generally safer than hard deletion. Implement Account Update Endpoint: Create endpoint: e.g., PUT /users/me. Requires user authentication. Accept fields like firstName, lastName, email, password (with current password for verification). Use Keycloak Admin API to update user attributes. Email Change: If the email is updated, trigger the email verification flow for the new email address. Mark the new email as unverified until confirmed. Password Change: Securely handle password updates via Keycloak Admin API (often requires current password). Implement Group Management Endpoints (Based on Design): View My Groups: e.g., GET /users/me/groups. Use Keycloak Admin API to retrieve groups the authenticated user is a member of. Leave Group: e.g., DELETE /users/me/groups/{group_id}. Use Keycloak Admin API to remove the user from the specified group. Join Group / Handle Invitations: Implement endpoints based on the specific join/invitation mechanism defined in the group design ticket (e.g., POST /groups/{group_id}/requests, POST /users/me/invitations/{inv_id}/accept). This may involve custom logic beyond simple Keycloak API calls if approval workflows are needed. Permissions: Ensure the Keycloak service account used by auth-service has sufficient permissions to perform these user-specific modifications (e.g., manage-users often covers this, but review needed). Testing: Add unit and integration tests for all new self-service endpoints. Deliverables: Updated auth-service source code with the new self-service user management endpoints. Updated test suite. Documentation for the new API endpoints.

Rows
Columns