Implemented API endpoint to return current users info (#4872)

* Implemented API endpoint to return current users info

* Added tests for login/whoami endpoint

* Added another test case for additional requested fields

* Fixed a security hole

* Removed the req.query.additionalFields test case as well as the allowedFields feature

* Added 2 more test cases as requested to test out whoamiFields

---------

Co-authored-by: Robert Means <robert@apostrophecms.com>

Author: sombitganguly

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ### Adds
 
+* Implemented GET /api/v1/@apostrophecms/login/whoami route such that it returns the details of the currently logged in user; added the route to the login module.
 * Adds keyboard shortcuts for manipulating widgets in areas. Includes Cut, Copy, Paste, Delete, and Duplicate.
 * Adds dynamic choices working with piece manager filters. 
 * Allow `import.imageTags` (array of image tag IDs) to be passed to the rich text widget when importing (see https://docs.apostrophecms.org/reference/api/rich-text.html#importing-inline-images).

modules/@apostrophecms/login/index.js

@@ -69,7 +69,9 @@ module.exports = {
       allowedAttempts: 3,
       perMinutes: 1,
       lockoutMinutes: 1
-    }
+    },
+    minimumWhoamiFields: [ '_id', 'username', 'title', 'email' ],
+    whoamiFields: []
   },
   async init(self) {
     self.passport = new Passport();
@@ -351,6 +353,22 @@ module.exports = {
         // it should be accessed via POST because the result
         // may differ by individual user session and should not
         // be cached
+        async whoami (req) {
+          if (!req.user) {
+            throw self.apos.error('notfound');
+          }
+
+          const fields = new Set([ ...self.options.minimumWhoamiFields, ...self.options.whoamiFields ]);
+          const user = {};
+
+          for (const field of fields) {
+            if (req.user[field] !== undefined) {
+              user[field] = req.user[field];
+            }
+          }
+
+          return user;
+        },
         async context(req) {
           return self.getContext(req);
         },

package.json

@@ -36,7 +36,7 @@
     "@apostrophecms/vue-material-design-icons": "^1.0.0",
     "@ctrl/tinycolor": "^4.1.0",
     "@floating-ui/dom": "^1.5.3",
-    "@opentelemetry/api": "^1.0.4",
+    "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/semantic-conventions": "^1.0.1",
     "@paralleldrive/cuid2": "^2.2.2",
     "@tiptap/extension-color": "^2.4.0",

test/login.js

@@ -867,4 +867,82 @@ describe('Login', function() {
       }
     );
   });
+
+  it('should return an error with code 404 at GET login/whoami when user is not logged in', async function() {
+    try {
+      await apos.http.get('/api/v1/@apostrophecms/login/whoami');
+      assert.fail('Expected error but got success');
+    } catch (err) {
+      assert.strictEqual(err.status, 404);
+      assert(err.message.includes('notfound'));
+    }
+  });
+
+  it('should return user data at GET login/whoami when user is logged in', async function() {
+
+    const jar = apos.http.jar();
+
+    await apos.http.post(
+      '/api/v1/@apostrophecms/login/login',
+      {
+        method: 'POST',
+        body: {
+          username: 'HarryPutter',
+          password: 'crookshanks',
+          session: true
+        },
+        jar
+      }
+    );
+
+    const whoamiResponse = await apos.http.get('/api/v1/@apostrophecms/login/whoami', { jar });
+    assert.ok(whoamiResponse._id);
+    assert.strictEqual(whoamiResponse.username, 'HarryPutter');
+    assert.strictEqual(whoamiResponse.title, 'Harry Putter');
+    assert.strictEqual(whoamiResponse.email, 'hputter@aol.com');
+  });
+
+  it('should return user data with additional whoamiFields if explicitly added at GET login/whoami when user is logged in', async function() {
+
+    const jar = apos.http.jar();
+
+    apos.modules['@apostrophecms/login'].options.whoamiFields = [ 'role' ];
+
+    await apos.http.post(
+      '/api/v1/@apostrophecms/login/login',
+      {
+        method: 'POST',
+        body: {
+          username: 'HarryPutter',
+          password: 'crookshanks',
+          session: true
+        },
+        jar
+      }
+    );
+
+    const whoamiResponse = await apos.http.get('/api/v1/@apostrophecms/login/whoami', { jar });
+    assert.strictEqual(whoamiResponse.role, 'admin');
+  });
+
+  it('should not return user data with additional whoamiFields if not explicitly added at GET login/whoami when user is logged in', async function() {
+
+    const jar = apos.http.jar();
+
+    await apos.http.post(
+      '/api/v1/@apostrophecms/login/login',
+      {
+        method: 'POST',
+        body: {
+          username: 'HarryPutter',
+          password: 'crookshanks',
+          session: true
+        },
+        jar
+      }
+    );
+
+    const whoamiResponse = await apos.http.get('/api/v1/@apostrophecms/login/whoami', { jar });
+    assert.ok(!('role' in whoamiResponse));
+  });
 });