Return user information in auth.pl if sent with a specific parameter (eg. ?info=json)

[alexgarel]

We need to know some information like:

• is a user a moderator
• what is it's preferred language

for services like open-prices / nutripatrol / hungergames

It should be quite easy to add this functionality to auth.pl so that if there is a ?info=json parameter, we would return a json with useful information (maybe avoid revealing email for now)

[hangy]

What's the timeframe? We want to move a lot of this data to Keycloak (#1596), so that it could be available as user claims. If we add it to auth.pl now (it's really not an auth feature, but a user profile feature, but I digress, we'd have to proxy the request it to Keycloak afterwards.

[alexgarel]

@hangy it's fairly urgent… for example NutriPatrol needs it to be deployed (only moderators should access moderation images).

It's only for internal tools (that use the cookie), so:

• we should not advertise it in the documentation
• we still would have to forward request to keycloak as you say, but we could remove it after a short period, as soon as those tools moves to keycloak API

cc @Valimp @john-gom @stephanegigandet @alexfauquette

[alexfauquette]

NutriPatrol needs it to be deployed

If it's blocking, you still have the option of hard coding a list of username as nutripatrol moderator

[stephanegigandet]

I'm adding it.

[stephanegigandet]

(maybe avoid revealing email for now)

In fact we currently do return the email now (try https://world.openfoodfacts.org/cgi/auth.pl?body=1 )
Maybe not a good idea as a XSS attack would allow to get the email.