fix: Reduce scope of list users API for non admin users (#898)

Co-authored-by: Tim Nguyen <thingut@amazon.com>
awslabs · Feb 3, 2022 · 1999b26 · 1999b26
1 parent 0a3ea5c
commit 1999b26
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 3 deletions.
diff --git a/addons/addon-base-raas/packages/base-raas-services/lib/user/__tests__/user-service.test.js b/addons/addon-base-raas/packages/base-raas-services/lib/user/__tests__/user-service.test.js
@@ -37,6 +37,7 @@ jest.mock('@aws-ee/base-services/lib/settings/env-settings-service');
 const SettingsServiceMock = require('@aws-ee/base-services/lib/settings/env-settings-service');
 
 jest.mock('../../user-roles/user-roles-service');
+const _ = require('lodash');
 const UserRolesServiceMock = require('../../user-roles/user-roles-service');
 
 const UserService = require('../user-service');
@@ -337,11 +338,21 @@ describe('UserService', () => {
       identityProviderId: 'ned2',
     };
 
-    it('should list all users', async () => {
+    it('admin: should list all users with all fields', async () => {
       // OPERATE
       dbService.table.scan.mockResolvedValueOnce([user1, user2]);
       const result = await service.listUsers({ principal: { isAdmin: true } }, {});
       expect(result).toEqual([user1, user2]);
     });
+
+    it('researcher: should list all users with subset of fields', async () => {
+      // OPERATE
+      dbService.table.scan.mockResolvedValueOnce([user1, user2]);
+      const result = await service.listUsers({ principal: { isAdmin: false } }, {});
+      const expectedUser1 = _.pick(user1, ['firstName', 'lastName', 'email', 'uid', 'username']);
+      const expectedUser2 = _.pick(user2, ['firstName', 'lastName', 'email', 'uid', 'username']);
+
+      expect(result).toEqual([expectedUser1, expectedUser2]);
+    });
   });
 });
diff --git a/addons/addon-base-raas/packages/base-raas-services/lib/user/user-service.js b/addons/addon-base-raas/packages/base-raas-services/lib/user/user-service.js
@@ -161,8 +161,12 @@ class UserService extends BaseUserService {
 
     const isAdmin = _.get(requestContext, 'principal.isAdmin', false);
 
-    const fieldsToOmit = isAdmin ? ['encryptedCreds'] : ['encryptedCreds', 'userRole'];
-    const sanitizedUsers = users.map(user => _.omit(user, fieldsToOmit));
+    let sanitizedUsers = [];
+    if (isAdmin) {
+      sanitizedUsers = users.map(user => _.omit(user, ['encryptedCreds']));
+    } else {
+      sanitizedUsers = users.map(user => _.pick(user, ['firstName', 'lastName', 'email', 'uid', 'username']));
+    }
     return sanitizedUsers;
   }