commit 3c288deadca0ac6e78cd1f39ac42cfd35a5d4d6a
author Edwin Kempin <ekempin@google.com> Tue Aug 27 14:21:39 2024 +0000
committer Edwin Kempin <ekempin@google.com> Wed Aug 28 14:33:14 2024 +0000
tree b428af232bd7314ba24d966bf5349fde47001f0f
parent 8099b47ddf343e1060b17dd0e60ada4d660bdd27

Add REST endpoint to retrieve the account state with a single request

The new REST endpoint retrieves the superset of all information related
to an account. This information is useful to inspect issues with the
account and its permissions.

For now we return the account details, the account capabilities, the
groups that contain the user as a member and the account external IDs.

This is the information that we ask users for when there is an issue
with the account or the account permissions. All this information is
already available via REST, but collecting it requires multiple calls
and having a dedicated REST endpoint that collects all relevant data at
once makes it simpler to ask the user for this information.

Also, in a follow-up change we intend to include further data into the
response, a key-value map that is retrieved from an extension point.
This way at Google we can extend the account state with custom
information (e.g. whether the user is a Googler, whether the user has
read access on host level and whether a trusted device is used). A part
of this information is computed from the user's session and cannot be
computed onbehalf of another user (not because it's fundamentally
infeasible, but because our current APIs don't support it). This is why
for now it's only possible to retrieve the own account state, but not
the account state of other users (even not for admins). Once we fix our
internal APIs it would be desireable to allow admins to get the account
state for other users. This way we would no longer need to ask the user
to provide us this information when investigating account issues, but
we could just retrieve this information ourselves.

Having the new REST endpoint will greatly simplify investigating account
and permission issues:
1. Ask the user for their account state information (single REST call,
   we may offer a screen for it that allows the user to copy&paste this
   information)
2. Check the account consistency (admin check)
3. Investigate permission issues with the Check Access REST endpoint

Without the new REST endpoint 1. requires the affected user to run
multiple commands to collect the information which often results into
multiple roundtrips, slowing down the investigation. Even worse, some of
the required information currently cannot be provided by external users
(e.g. checking whether the user has read access on host level requires
the user to run an internal-only command). Having the new REST endpoint
this is something that we can address, once we add an extension point in
a follow-up change that allows plugins to provide further account state
data.

Bug: Google b/330836100
Release-Notes: Added a REST endpoint to retrieve the account state
Change-Id: Id8928cdbd9c5117db166c618eece499eff3ecba1
Signed-off-by: Edwin Kempin <ekempin@google.com>