API: Handle authorization

pbastia commented 3 months ago

Description:

The current API receives a user name from the next-auth token That user name is matched up with a role from the user table It can be queried by the frontend as well to make decisions on what to show

@DataVillage is there a particular pattern you have in mind for this?

Acceptance Criteria:

Given When Then

Development Checklist:

[ ] Checklist item
[ ] Checklist item
[ ] Checklist item
[ ] Meets the DOD

Definition of Ready (Note: If any of these points are not applicable, mark N/A)

[ ] User story is included
[ ] User role and type are identified
[ ] Acceptance criteria are included
[ ] Wireframes are included (if required)
[ ] Design / Solution is accepted by Product Owner
[ ] Dependencies are identified (technical, business, regulatory/policy)
[ ] Story has been estimated (under 13 pts)

·Definition of Done (Note: If any of these points are not applicable, mark N/A)

[ ] Acceptance criteria are tested by the CI pipeline
[ ] UI meets accessibility requirements
[ ] Configuration changes are documented, documentation and designs are updated
[ ] Passes code peer-review
[ ] Passes QA of Acceptance Criteria with verification in Dev and Test
[ ] Ticket is ready to be merged to main branch
[ ] Can be demoed in Sprint Review
[ ] Bugs or future work cards are identified and created
[ ] Reviewed and approved by Product Owner

Notes:

Dependencies

Blocked by
Blocking

pbastia commented 3 months ago

@BCerki I would say this is done as part of your first API card?

BCerki commented 3 months ago

@BCerki I would say this is done as part of your first API card?

We have an @authorize decorator that checks if the user role (from the withAuthorization middleware) is in the list of roles that are allowed to access the endpoint. That doesn't really sound like this ticket's description, though

mikevespi commented 2 months ago

Wait until #256 is done before digging in to this. Decisions there will likely require rework of this.

Sepehr-Sobhani commented 2 months ago

Future work captured in tickets:

pbastia commented 2 months ago

cc @patriciarussellCAS @rdromey , we can close this one

bcgov / cas-obps