Implement profiles, friend consent, invitations, and visibility #19

New issue

Open

opened 2026-11-07 20:27:04 +00:00 by etashj · 0 comments

etashj commented

2026-11-07 20:27:04 +00:00

Member

Goal

Restore the friend features in crates/courses-web-api/src/backend/friends.rs, whose handlers currently return 501.

Scope

Register or resolve profiles from verified identity without creating profiles during /api/me lookup.
Implement friend request, accept, remove, and list flows with recipient checks and explicit consent.
Implement expiring, single-use invitation creation, redemption, and revocation.
Implement friend visibility settings and restrict shared-course information to the allowed audience.
Match sites/web/src/lib/contracts.ts; add OpenAPI coverage and tests for acceptance, duplicate requests, expiry/reuse, revocation, and cross-user privacy.

Done when

The existing friends UI works end to end, and unauthorized users cannot see another person’s private data. Update feature documentation.

See sites/docs/src/backend-development.md and sites/docs/src/api/user.md.

## Goal Restore the friend features in `crates/courses-web-api/src/backend/friends.rs`, whose handlers currently return 501. ## Scope - Register or resolve profiles from verified identity without creating profiles during `/api/me` lookup. - Implement friend request, accept, remove, and list flows with recipient checks and explicit consent. - Implement expiring, single-use invitation creation, redemption, and revocation. - Implement friend visibility settings and restrict shared-course information to the allowed audience. - Match `sites/web/src/lib/contracts.ts`; add OpenAPI coverage and tests for acceptance, duplicate requests, expiry/reuse, revocation, and cross-user privacy. ## Done when The existing friends UI works end to end, and unauthorized users cannot see another person’s private data. Update feature documentation. See `sites/docs/src/backend-development.md` and `sites/docs/src/api/user.md`.