When joining some groups, user may grant to group manager to "edit" their profile. The intend is to let the group manager (typically the teacher, instructor, ...) fix some personal information and change the password of a user who barely knows about his account on the website.
As the authentication is handled by the login-module, we need to provide the login-module with a proof that the current user is allowed to modify another user.
Acceptance criteria
[x] create a new service for requesting such a token for a given target user id
[x] the current user should only be allowed to request such a token if he is a manager (implicit or explicit) of a group of which the target user is a member and which (the group) has require_personal_info_access_approval === 'edit'
[x] the token should be encoded in aes-128-ecb with the usual client secret and contain, as json:
requester_id: the loginId of the current user
target_id : the loginId of the target user
expires : a unix timestamp of NOW + 30min
[x] the service should also return:
alg: the algorithm which has been used for creating the token. by decrease order of preference: AES-128-ECB, AES-256-CBC, AES-256-GCM - implement the one which requires reasonable time of implementation (otherwise, it can be move to another issue)
tag (optional) the public tag generated by the encoding (for instance in GCM)
Overview
When joining some groups, user may grant to group manager to "edit" their profile. The intend is to let the group manager (typically the teacher, instructor, ...) fix some personal information and change the password of a user who barely knows about his account on the website.
As the authentication is handled by the login-module, we need to provide the login-module with a proof that the current user is allowed to modify another user.
Acceptance criteria
require_personal_info_access_approval === 'edit'requester_id: theloginIdof the current usertarget_id: theloginIdof the target userexpires: a unix timestamp of NOW + 30min