feat: add profile api

[manoelhc]

Profile API Implementation with Permanent Profiles and JWT Authentication

Initial Setup and Planning

• [ ] Requirements Analysis:

  • [ ] Identify initial and potential future dynamic fields for the profile (e.g., photo URL, social links, bio).
  • [ ] Plan for the profile to remain intact and hidden instead of being deleted when the linked user account is deleted.

• [ ] Design Database Schema:

  • [ ] Design a schema that links profiles directly to user accounts, ensuring that the relationship allows for hiding profiles of deleted users.
  • [ ] Consider using a flag or status field in the user account table to indicate deleted accounts.

• [ ] Define API Endpoints:

  • POST /profile: Create a new user profile, automatically linking it to a user account.
  • GET /profile/{userId}: Retrieve the profile of an active user.
  • PUT /profile/{userId}: Update the profile, including adding new dynamic fields.
  • [ ] Design endpoints with the consideration that profiles are never deleted, only hidden if the linked user is marked as deleted.

Implementation

• [ ] JWT Authentication Integration:

  • [ ] Validate JWT tokens from the User API to authenticate requests.
  • [ ] Implement middleware for extracting and validating JWT tokens for authenticated access.

• [ ] Profile Management Logic:

  • [ ] Enable creating, retrieving, and updating profiles with support for dynamic fields.
  • [ ] Implement logic to hide profiles linked to deleted user accounts instead of deleting profiles.

• [ ] Security and Privacy:

  • [ ] Ensure that only owners or authorized roles can access and modify profiles.
  • [ ] Implement mechanisms to hide profiles of deleted users from all public and unauthorized accesses.

Testing

• [ ] Unit Tests:

  • [ ] Test creation, retrieval, and update functionalities, including dynamic field handling.
  • [ ] Test the logic that prevents the deletion of profiles and ensures profiles of deleted users are inaccessible to unauthorized users.

• [ ] Integration Tests:

  • [ ] Test the integration with the User API for authentication and authorization.
  • [ ] Test the complete flow, from user deletion affecting profile visibility to updating profiles with dynamic fields.

Documentation

• [ ] API Documentation:

  • [ ] Document the endpoints, highlighting the linkage to user accounts and the behavior upon user deletion.
  • [ ] Include details on handling dynamic fields in profile updates.

• [ ] Developer Guides:

  • [ ] Guide on managing dynamic fields in profiles.
  • [ ] Documentation on the process and implications of user deletion on profiles.

Deployment and Monitoring

• [ ] Deployment:

  • [ ] Deploy in a staged environment to test the integration and behavior under various scenarios, including user deletion.
  • [ ] Conduct security and performance assessments.

• [ ] Monitoring and Logging:

  • [ ] Implement logging for API activity, focusing on authentication, access to hidden profiles, and dynamic field updates.
  • [ ] Set up monitoring tools to oversee API performance and error rates.

Post-Deployment

• [ ] Feedback Loop:

  • [ ] Collect and incorporate feedback from users and developers on the profile visibility logic and dynamic fields management.
  • [ ] Plan iterative updates based on feedback and evolving requirements.

• [ ] Compliance Review:

  • [ ] Ensure the handling of profiles, especially those linked to deleted users, complies with data protection and privacy laws.