User profile endpoint returns information for non-logged in user when authenticating via a token.

[pgulley]

As written in the title- invoking user_profile (which hits '/auth/profile' returns a functionally null response instead of the full user profile information.

import mediacloud.api token = ################ search_api = mediacloud.api.SearchApi(token) print(search_api.user_profile())
>> {'isActive': False}

It returns this value whether or not the provided token is valid.

[Evan-Leon]

I believe @rahulbot raised some concerns #763 (comment) about potential security risks, but I am open to making it more functional

[pgulley]

The use-case is that we want to be able to identify what permissions a user has based on their token- so some kind of id and all of the user permissions should be able to be returned here!
Getting the email would be nice too- I'd like to be able to auto-populate user emails for sous-chef, but that's easy enough to have users provide themselves, since I think there is legitimate concern about that.

Per @rahulbot's concerns though, I do agree that everything else should be kept back.

[philbudne]

Thinking (far) ahead, as I often do, I can imagine someday having a stand-alone mediacloud auth server that issues JWTs (JSON Web Tokens) that describe the user's capabilities and can be used with a variety of MC services... Since the capabilities might include mcweb groups, maybe it's not too soon to be thinking about that! p