Add basic scaffolding for custom authorization functions

[calebbourg]

Description

Sets up pattern for protecting various resources through authorization. This very likely will evolve over time.

The basic idea is as follows:

The new web::protect module will encapsulate various submodules which will each have a number of authorization policies. The policy names (at least for the time being) should map directly to the controller action they are protecting.
Ex web::protect::coaching_relationships::index => web::controller::organization::coaching_relationships::index.

We can see if this pattern for code organization holds up as we implement more policies but for now it seemed reasonable.

GitHub Issue: [Closes|Fixes|Resolves] #your GitHub issue number here

Changes

• Adds web::protect module for encapsulating authorization policies
• Adds protect::coaching_relationships::index function for authorizing coaching_relationships
• Protects GET organizations/:organization_id/coaching_relationships using the new function with from_fn_with_state

Testing Strategy

I used cURL to test this:

Valid organization_id

caleb@calebs-MBP-2 refactor % curl 'http://localhost:4000/organizations/90e1d612-9d5e-4a5d-a237-2ec1cb0b34ee/coaching_relationships' \
  -H 'Accept: application/json, text/plain, */*' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Connection: keep-alive' \
  -H 'Cookie: id=my-cookie' \
  -H 'Origin: http://localhost:3000' \
  -H 'Referer: http://localhost:3000/' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-site' \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36' \
  -H 'X-Version: 0.0.1' \
  -H 'sec-ch-ua: "Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"'
{"status_code":200,"data":[{"id":"c6026a63-bace-4e83-bfda-5987e63a5193","coach_id":"01794e48-cbd6-4b7a-a391-0f40e6f28b5c","coachee_id":"eacaa455-e78a-4bce-802e-d8cd8045b736","coach_first_name":"Jim","coach_last_name":"Hodapp","coachee_first_name":"Caleb","coachee_last_name":"Bourg","created_at":"2024-12-03T17:39:15.638425Z","updated_at":"2024-12-03T17:39:15.638425Z"}]}%

Invalid organization_id

caleb@calebs-MBP-2 refactor % curl 'http://localhost:4000/organizations/90e1d612-9d52-4a5d-a237-2ec1cb0b34ee/coaching_relationships' \
  -H 'Accept: application/json, text/plain, */*' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Connection: keep-alive' \
  -H 'Cookie: id=FJd0ETgOe6PM4MhvZwWuXA' \
  -H 'Origin: http://localhost:3000' \
  -H 'Referer: http://localhost:3000/' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-site' \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36' \
  -H 'X-Version: 0.0.1' \
  -H 'sec-ch-ua: "Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"'
UNAUTHORIZED%

Concerns

describe any concerns that might be worth mentioning or discussing

[calebbourg]

This file I just changed to use the user derived from the JWT rather than the user_id that is passed in as query params. Somewhat adjacent to the purpose of the rest of the code.

[jhodapp]

Superseded by #81