Merged in feature/textExtractionsPart4 (pull request #197)

implement GET /identity

* GET /identity

api/queryAPI/identityHandlers.go

@@ -0,0 +1,89 @@
+// identityHandlers.go implements the identity API handler for user role discovery.
+// This handler allows authenticated users to discover their assigned roles and
+// the permissions granted by those roles from Permit.io.
+package queryapi
+
+import (
+	"net/http"
+	"time"
+
+	"queryorchestration/internal/cognitoauth"
+	"queryorchestration/internal/usermanagement"
+
+	"github.com/labstack/echo/v4"
+)
+
+// GetIdentity returns the currently authenticated user's roles and permissions from Permit.io.
+// GET /identity
+//
+// This endpoint requires authentication but no authorization - any authenticated
+// user can retrieve their own roles and the permissions granted by those roles.
+//
+// Returns:
+//   - 200: IdentityResponse with roles array including permissions
+//   - 401: Unauthorized if user is not authenticated
+//   - 502: Bad gateway if Permit.io call fails
+func (ctrl *Controllers) GetIdentity(ctx echo.Context) error {
+	// Extract user subject ID from JWT token
+	userSubject, ok := cognitoauth.GetUserSubject(ctx)
+	if !ok {
+		return ctx.JSON(http.StatusUnauthorized, ErrorMessage{
+			Message: "Could not identify user from token",
+		})
+	}
+
+	// Get role keys from Permit.io
+	httpClient := &http.Client{Timeout: 10 * time.Second}
+	permitConfig := ctrl.getPermitConfig()
+
+	roleKeys, err := usermanagement.GetPermitUserRoles(httpClient, permitConfig, userSubject)
+	if err != nil {
+		ctrl.cfg.GetAuthLogger().Error("Failed to get user roles from Permit.io",
+			"error", err,
+			"user_subject", userSubject)
+		return ctx.JSON(http.StatusBadGateway, ErrorMessage{
+			Message: "Failed to retrieve roles from authorization service",
+		})
+	}
+
+	// Build response with role details
+	roles := make([]IdentityRole, 0, len(roleKeys))
+
+	for _, roleKey := range roleKeys {
+		// Get role details including permissions
+		roleDetails, err := usermanagement.GetRoleDetails(httpClient, permitConfig, roleKey)
+		if err != nil {
+			ctrl.cfg.GetAuthLogger().Warn("Failed to get role details from Permit.io",
+				"error", err,
+				"role_key", roleKey)
+			// Include role with empty permissions if details fetch fails
+			roles = append(roles, IdentityRole{
+				Key:         roleKey,
+				Name:        roleKey,
+				Permissions: []string{},
+			})
+			continue
+		}
+
+		permissions := roleDetails.Permissions
+		if permissions == nil {
+			permissions = []string{}
+		}
+
+		var description *string
+		if roleDetails.Description != "" {
+			description = &roleDetails.Description
+		}
+
+		roles = append(roles, IdentityRole{
+			Key:         roleDetails.Key,
+			Name:        roleDetails.Name,
+			Description: description,
+			Permissions: permissions,
+		})
+	}
+
+	return ctx.JSON(http.StatusOK, IdentityResponse{
+		Roles: roles,
+	})
+}