Estimate

6 hours

• 2h for backend model and controller additions
• 2h for test coverage
• 2h for documentation and review

Feature branch:

rksuma@Ramakrishnans-MacBook-Pro sztab % git checkout -b feature/sz-32-user-self-service
Switched to a new branch 'feature/sz-32-user-self-service'
rksuma@Ramakrishnans-MacBook-Pro sztab % 

User Self-Service Endpoints (SZ-38)

Sztab provides authenticated users with basic self-service account management. These endpoints work under session-auth, using the currently logged-in user from the SecurityContextHolder.

Get Current User

GET /api/users/me

Returns the profile of the authenticated user.

Example response:

200 OK { "id": 1, "username": "admin", "email": "admin@example.com", "fullName": "Administrator", "mustChangePassword": false }

Update Own Profile

PUT /api/users/me

Allows the user to update email and full name.

Example request:

{ "email": "new@example.com", "fullName": "New Name" }

Example response:

200 OK { "id": 1, "username": "admin", "email": "new@example.com", "fullName": "New Name" }

Change Password

POST /api/users/change-password

Allows the authenticated user to change their password using a secure, two-field request.

Example request:

{ "oldPassword": "current123", "newPassword": "newSecureP@ss" }

Successful response:

200 OK { "message": "Password changed successfully" }

Error response (wrong old password):

400 Bad Request { "error": "Invalid old password" }

OpenAPI Additions

/api/users/me:
  get:
    summary: Get current authenticated user's profile
    security:
      - sessionAuth: []
    responses:
      '200':
        description: User profile

  put:
    summary: Update current user's profile
    security:
      - sessionAuth: []
    requestBody:
      required: true
    responses:
      '200':
        description: Updated user profile

/api/users/change-password:
  post:
    summary: Change current user's password
    security:
      - sessionAuth: []
    requestBody:
      required: true
    responses:
      '200':
        description: Password updated successfully
      '400':
        description: Invalid old password