From e3c428afe3410eafdaade8c6dc57956a71eb22c5 Mon Sep 17 00:00:00 2001
From: Grady Ward <grady.b.ward@gmail.com>
Date: Mon, 22 Jan 2024 16:12:25 -0700
Subject: [PATCH 1/3] WIP

---
 frontend/lang/en.json                     | 27 +++++++++++------------
 frontend/pages/admin/initiative/index.vue |  6 +----
 frontend/pages/admin/initiative/new.vue   |  2 +-
 3 files changed, 15 insertions(+), 20 deletions(-)

diff --git a/frontend/lang/en.json b/frontend/lang/en.json
index 477d065..61cf075 100644
--- a/frontend/lang/en.json
+++ b/frontend/lang/en.json
@@ -309,19 +309,6 @@
     "Edit": "Edit",
     "Profile": "Profile"
   },
-  "initiative/invitations": {
-    "Create": "Create",
-    "Create Initiative Invitations": "Create Initiative Invitations",
-    "Heading": "Initaitive Invitations",
-    "Includes Illegal Characters": "Includes illegal characters",
-    "New Invitations": "New Invitations",
-    "New Invitations Help": "Create new invitations by clicking the button below. You can create as many invitations as you want, but each invitation can only be used once. Invitation codes must only contain alphanumeric characters (a-z, A-Z, 0-9), underscores and dashes. You can create multiple invitations at once by separating them with tabs, commas, newlines, or spaces.",
-    "No Invitations": "This initiative does not require an invitation to join - anyone who finds this initiative can join it.",
-    "Unused": "Unused",
-    "Yes Invitations": "This initiative requires an invitation (a unique, one-time code) to join. You can create these invitations below.",
-    "You can change": "You can change this behavior on the",
-    "edit initiative page": "edit initiative page"
-  },
   "lib/editor/portfolio": {
     "Created At": "Created At",
     "ID": "ID",
@@ -401,7 +388,19 @@
     "New Invitations": "New Invitations",
     "New Invitations Help": "Create new invitations by entering new values in the box below. If you don't care what the invitation codes look like you can press the randomize button to generate random ones. You can create as many invitations as you want, but each invitation can only be used once. Invitation codes must only contain alphanumeric characters (a-z, A-Z, 0-9), underscores and dashes. You can create multiple invitations at once by separating them with tabs, commas, newlines, or spaces.",
     "Generate Random": "Generate Random",
-    "Cancel": "Cancel"
+    "Cancel": "Cancel",
+    "Create": "Create",
+    "Heading": "Initaitive Invitations",
+    "Includes Illegal Characters": "Includes illegal characters",
+    "No Invitations": "This initiative does not require an invitation to join - anyone who finds this initiative can join it.",
+    "You can change": "You can change this behavior on the",
+    "edit initiative page": "edit initiative page"
+  },
+  "pages/admin/initiative/new": {
+    "New Initiative": "New Initiative",
+    "Paragraph1": "Initiatives are a way to organize portfolios for common analysis and reporting. They typicall correspond to a COP managed projects where investors are contributing data for analysis to a regulator.",
+    "Discard": "Discard",
+    "Save": "Save"
   },
   "pages/initiative/relationships": {
     "Actions": "Actions",
diff --git a/frontend/pages/admin/initiative/index.vue b/frontend/pages/admin/initiative/index.vue
index 65f3cfd..b6840a3 100644
--- a/frontend/pages/admin/initiative/index.vue
+++ b/frontend/pages/admin/initiative/index.vue
@@ -19,10 +19,6 @@ const deleteInitiative = (id: string) => withLoading(
 <template>
   <StandardContent>
     <TitleBar title="Initiatives" />
-    <p>
-      TODO(#38) Add I18n
-      General information about initiatives here.
-    </p>
     <PVDataTable
       :value="initiatives"
       class="w-full"
@@ -41,7 +37,7 @@ const deleteInitiative = (id: string) => withLoading(
         sortable
       >
         <template #body="slotProps">
-          {{ humanReadableTimeFromStandardString(slotProps.data.createdAt) }}
+          {{ humanReadableTimeFromStandardString(slotProps.data.createdAt).value }}
         </template>
       </PVColumn>
       <PVColumn header="View">
diff --git a/frontend/pages/admin/initiative/new.vue b/frontend/pages/admin/initiative/new.vue
index 63ecb0a..1141b1b 100644
--- a/frontend/pages/admin/initiative/new.vue
+++ b/frontend/pages/admin/initiative/new.vue
@@ -43,7 +43,7 @@ const tt = (key: string) => t(`pages/admin/initiative/new.${key}`)
   <StandardContent>
     <TitleBar :title="tt('New Initiative')" />
     <p>
-      TODO(#80) Initiative Copy Goes Here
+      {{ tt('Paragraph1' ) }}
     </p>
     <InitiativeEditor
       v-model:editorValues="editorValues"

From 7450f7f6956fec190367b957ddcce03fd6d546f8 Mon Sep 17 00:00:00 2001
From: Grady Ward <grady.b.ward@gmail.com>
Date: Tue, 23 Jan 2024 10:56:33 -0700
Subject: [PATCH 2/3] Allows Anonymous Initiative Viewing

---
 cmd/server/main.go                            |  32 +++++-
 cmd/server/pactasrv/analysis.go               |   2 +-
 cmd/server/pactasrv/authz.go                  |  12 ++
 cmd/server/pactasrv/conv/helpers.go           |  18 ++-
 cmd/server/pactasrv/conv/pacta_to_oapi.go     |  11 +-
 cmd/server/pactasrv/initiative.go             | 107 ++++++++++++------
 .../pactasrv/initiative_user_relationship.go  |  34 ------
 frontend/components/initiative/Toolbar.vue    |  76 -------------
 frontend/composables/useInitiativeData.ts     |  53 +++++++++
 frontend/composables/usePACTA.ts              |   2 +-
 frontend/lang/en.json                         |   4 +-
 frontend/lib/editor/initiative.ts             |   4 +
 .../generated/pacta/models/Initiative.ts      |   5 +
 .../pacta/services/DefaultService.ts          |  39 -------
 frontend/pages/admin/initiative/new.vue       |   1 +
 frontend/pages/initiative/[id].vue            |  85 +++++++++++---
 frontend/pages/initiative/[id]/edit.vue       |   8 +-
 frontend/pages/initiative/[id]/index.vue      |  35 +++---
 frontend/pages/initiative/[id]/internal.vue   |  11 +-
 .../pages/initiative/[id]/invitations.vue     |  12 +-
 .../pages/initiative/[id]/relationships.vue   |  29 +----
 frontend/plugins/msal.ts                      |  27 ++---
 openapi/pacta.yaml                            |  47 +-------
 session/session.go                            |  19 ++++
 24 files changed, 341 insertions(+), 332 deletions(-)
 delete mode 100644 frontend/components/initiative/Toolbar.vue
 create mode 100644 frontend/composables/useInitiativeData.ts

diff --git a/cmd/server/main.go b/cmd/server/main.go
index e71a355..6880cdd 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -8,6 +8,7 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"regexp"
 	"strings"
 	"time"
 
@@ -314,7 +315,7 @@ func run(args []string) error {
 			zaphttplog.NewMiddleware(logger, zaphttplog.WithConcise(false)),
 			chimiddleware.Recoverer,
 			jwtauth.Verifier(jwtauth.New("EdDSA", nil, jwKey)),
-			jwtauth.Authenticator,
+			requireJWTIfNotPublicEndpoint,
 			session.WithAuthn(logger, db),
 		}, addl...)
 	}
@@ -372,6 +373,24 @@ func run(args []string) error {
 	return nil
 }
 
+var publicEndpoints = []*regexp.Regexp{
+	regexp.MustCompile(`^/initiative/[^/]*$`),
+}
+
+func requireJWTIfNotPublicEndpoint(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		path := r.URL.Path
+		for _, re := range publicEndpoints {
+			if re.MatchString(path) {
+				r = r.WithContext(session.WithAllowedAnonymous(r.Context()))
+				next.ServeHTTP(w, r)
+				return
+			}
+		}
+		jwtauth.Authenticator(next).ServeHTTP(w, r)
+	})
+}
+
 func rateLimitMiddleware(maxReq int, windowLength time.Duration) func(http.Handler) http.Handler {
 	// This example uses an in-memory rate limiter for simplicity, an application
 	// that will be running multiple API instances should likely use something like
@@ -381,6 +400,17 @@ func rateLimitMiddleware(maxReq int, windowLength time.Duration) func(http.Handl
 		maxReq,
 		windowLength,
 		httprate.WithKeyFuncs(func(r *http.Request) (string, error) {
+			if session.IsAllowedAnonymous(r.Context()) {
+				// Rate limit by IP address if the user is anonymous.
+				ip := r.Header.Get("X-Real-IP")
+				if ip == "" {
+					ip = r.Header.Get("X-Forwarded-For")
+				}
+				if ip == "" {
+					ip = r.RemoteAddr
+				}
+				return ip, nil
+			}
 			_, claims, err := jwtauth.FromContext(r.Context())
 			if err != nil {
 				return "", fmt.Errorf("failed to get claims from context: %w", err)
diff --git a/cmd/server/pactasrv/analysis.go b/cmd/server/pactasrv/analysis.go
index 4316975..9edf454 100644
--- a/cmd/server/pactasrv/analysis.go
+++ b/cmd/server/pactasrv/analysis.go
@@ -388,7 +388,7 @@ type initiativeAnalysis struct {
 
 func (ia *initiativeAnalysis) checkAuth(ctx context.Context, tx db.Tx) error {
 	// This crudely tests whether or not a user is a manager of the initiative.
-	if err := ia.s.initiativeDoAuthzAndAuditLog(ctx, ia.iID, pacta.AuditLogAction_Update); err != nil {
+	if _, err := ia.s.initiativeDoAuthzAndAuditLog(ctx, ia.iID, pacta.AuditLogAction_Update); err != nil {
 		return err
 	}
 	i, err := ia.s.DB.Initiative(tx, ia.iID)
diff --git a/cmd/server/pactasrv/authz.go b/cmd/server/pactasrv/authz.go
index 8033407..d54a5b1 100644
--- a/cmd/server/pactasrv/authz.go
+++ b/cmd/server/pactasrv/authz.go
@@ -79,15 +79,27 @@ func notFoundOrUnauthorized[T ~string](actorInfo actorInfo, action pacta.AuditLo
 }
 
 func (s *Server) auditLogIfAuthorizedOrFail(ctx context.Context, status *authzStatus) error {
+	zapFields := []zap.Field{
+		zap.String("actor_id", status.actorUserID()),
+		zap.String("action", string(status.action)),
+		zap.String("target_type", string(status.primaryTargetType)),
+		zap.String("target_id", status.primaryTargetID),
+	}
 	if !status.isAuthorized {
+		zapFields = append(zapFields, zap.String("reason", "is_authorized_false"))
+		s.Logger.Warn("not authorized", zapFields...)
 		return notFoundOrUnauthorized(status.actorInfo, status.action, status.primaryTargetType, status.primaryTargetID)
 	}
 	al, err := status.ToAuditLog()
 	if err != nil {
+		zapFields = append(zapFields, zap.String("reason", "to_audit_log_failure"), zap.Error(err))
+		s.Logger.Warn("not authorized", zapFields...)
 		return err
 	}
 	_, err = s.DB.CreateAuditLog(s.DB.NoTxn(ctx), al)
 	if err != nil {
+		zapFields = append(zapFields, zap.String("reason", "create_audit_log_failure"), zap.Error(err))
+		s.Logger.Warn("not authorized", zapFields...)
 		return oapierr.Internal("creating audit log failed", zap.Error(err))
 	}
 	return nil
diff --git a/cmd/server/pactasrv/conv/helpers.go b/cmd/server/pactasrv/conv/helpers.go
index 010350f..f616746 100644
--- a/cmd/server/pactasrv/conv/helpers.go
+++ b/cmd/server/pactasrv/conv/helpers.go
@@ -1,6 +1,12 @@
 package conv
 
-import "time"
+import (
+	"fmt"
+	"time"
+
+	"github.com/RMI/pacta/oapierr"
+	"go.uber.org/zap"
+)
 
 func ptr[T any](t T) *T {
 	return &t
@@ -52,10 +58,16 @@ func convAll[I any, O any](is []I, f func(I) (O, error)) ([]O, error) {
 	return os, nil
 }
 
-func dereferenceAll[T any](ts []*T) []T {
+func dereference[T any](ts []*T, e error) ([]T, error) {
+	if e != nil {
+		return nil, e
+	}
 	result := make([]T, len(ts))
 	for i, t := range ts {
+		if t == nil {
+			return nil, oapierr.Internal("nil pointer found in derference", zap.String("type", fmt.Sprintf("%T", t)), zap.Int("index", i))
+		}
 		result[i] = *t
 	}
-	return result
+	return result, nil
 }
diff --git a/cmd/server/pactasrv/conv/pacta_to_oapi.go b/cmd/server/pactasrv/conv/pacta_to_oapi.go
index 7a93c88..7ea15fa 100644
--- a/cmd/server/pactasrv/conv/pacta_to_oapi.go
+++ b/cmd/server/pactasrv/conv/pacta_to_oapi.go
@@ -42,6 +42,10 @@ func InitiativeToOAPI(i *pacta.Initiative) (*api.Initiative, error) {
 	if err != nil {
 		return nil, oapierr.Internal("initiativeToOAPI: portfolioInitiativeMembershipToOAPIInitiative failed", zap.Error(err))
 	}
+	iurs, err := dereference(convAll(i.InitiativeUserRelationships, InitiativeUserRelationshipToOAPI))
+	if err != nil {
+		return nil, oapierr.Internal("initiativeToOAPI: initiativeUserRelationshipToOAPI failed", zap.Error(err))
+	}
 	lang, err := LanguageToOAPI(i.Language)
 	if err != nil {
 		return nil, oapierr.Internal("initiativeToOAPI: languageToOAPI failed", zap.Error(err))
@@ -59,6 +63,7 @@ func InitiativeToOAPI(i *pacta.Initiative) (*api.Initiative, error) {
 		PublicDescription:              i.PublicDescription,
 		RequiresInvitationToJoin:       i.RequiresInvitationToJoin,
 		PortfolioInitiativeMemberships: pims,
+		InitiativeUserRelationships:    iurs,
 	}, nil
 }
 
@@ -250,7 +255,7 @@ func PortfolioToOAPI(p *pacta.Portfolio) (*api.Portfolio, error) {
 	}
 	pims, err := convAll(p.PortfolioInitiativeMemberships, portfolioInitiativeMembershipToOAPIInitiative)
 	if err != nil {
-		return nil, oapierr.Internal("initiativeToOAPI: portfolioInitiativeMembershipToOAPIInitiative failed", zap.Error(err))
+		return nil, oapierr.Internal("portfolioToOAPI: portfolioInitiativeMembershipToOAPIInitiative failed", zap.Error(err))
 	}
 	hd, err := HoldingsDateToOAPI(p.Properties.HoldingsDate)
 	if err != nil {
@@ -408,7 +413,7 @@ func AnalysisToOAPI(a *pacta.Analysis) (*api.Analysis, error) {
 	if a == nil {
 		return nil, oapierr.Internal("analysisToOAPI: can't convert nil pointer")
 	}
-	aas, err := convAll(a.Artifacts, AnalysisArtifactToOAPI)
+	aas, err := dereference(convAll(a.Artifacts, AnalysisArtifactToOAPI))
 	if err != nil {
 		return nil, oapierr.Internal("analysisToOAPI: analysisArtifactsToOAPI failed", zap.Error(err))
 	}
@@ -440,7 +445,7 @@ func AnalysisToOAPI(a *pacta.Analysis) (*api.Analysis, error) {
 		CompletedAt:       timeToNilable(a.CompletedAt),
 		FailureCode:       fc,
 		FailureMessage:    fm,
-		Artifacts:         dereferenceAll(aas),
+		Artifacts:         aas,
 		OwnerId:           string(a.Owner.ID),
 	}, nil
 }
diff --git a/cmd/server/pactasrv/initiative.go b/cmd/server/pactasrv/initiative.go
index 2e4704e..4518c8e 100644
--- a/cmd/server/pactasrv/initiative.go
+++ b/cmd/server/pactasrv/initiative.go
@@ -50,7 +50,7 @@ func (s *Server) CreateInitiative(ctx context.Context, request api.CreateInitiat
 // (PATCH /initiative/{id})
 func (s *Server) UpdateInitiative(ctx context.Context, request api.UpdateInitiativeRequestObject) (api.UpdateInitiativeResponseObject, error) {
 	id := pacta.InitiativeID(request.Id)
-	if err := s.initiativeDoAuthzAndAuditLog(ctx, id, pacta.AuditLogAction_Update); err != nil {
+	if _, err := s.initiativeDoAuthzAndAuditLog(ctx, id, pacta.AuditLogAction_Update); err != nil {
 		return nil, err
 	}
 	mutations := []db.UpdateInitiativeFn{}
@@ -97,7 +97,7 @@ func (s *Server) UpdateInitiative(ctx context.Context, request api.UpdateInitiat
 // (DELETE /initiative/{id})
 func (s *Server) DeleteInitiative(ctx context.Context, request api.DeleteInitiativeRequestObject) (api.DeleteInitiativeResponseObject, error) {
 	id := pacta.InitiativeID(request.Id)
-	if err := s.initiativeDoAuthzAndAuditLog(ctx, id, pacta.AuditLogAction_Delete); err != nil {
+	if _, err := s.initiativeDoAuthzAndAuditLog(ctx, id, pacta.AuditLogAction_Delete); err != nil {
 		return nil, err
 	}
 	buris, err := s.DB.DeleteInitiative(s.DB.NoTxn(ctx), id)
@@ -113,9 +113,13 @@ func (s *Server) DeleteInitiative(ctx context.Context, request api.DeleteInitiat
 // Returns an initiative by ID
 // (GET /initiative/{id})
 func (s *Server) FindInitiativeById(ctx context.Context, request api.FindInitiativeByIdRequestObject) (api.FindInitiativeByIdResponseObject, error) {
-	// TODO(#12) Allow Anonymous Access
+	actorInfo, err := s.getActorInfoOrAnon(ctx)
+	if err != nil {
+		return nil, err
+	}
 	id := pacta.InitiativeID(request.Id)
-	if err := s.initiativeDoAuthzAndAuditLog(ctx, id, pacta.AuditLogAction_ReadMetadata); err != nil {
+	info, err := s.initiativeDoAuthzAndAuditLog(ctx, id, pacta.AuditLogAction_ReadMetadata)
+	if err != nil {
 		return nil, err
 	}
 	i, err := s.DB.Initiative(s.DB.NoTxn(ctx), id)
@@ -125,11 +129,27 @@ func (s *Server) FindInitiativeById(ctx context.Context, request api.FindInitiat
 		}
 		return nil, oapierr.Internal("failed to load initiative", zap.String("initiative_id", request.Id), zap.Error(err))
 	}
-	portfolios, err := s.DB.PortfolioInitiativeMembershipsByInitiative(s.DB.NoTxn(ctx), i.ID)
-	if err != nil {
-		return nil, oapierr.Internal("failed to load portfolios for initiative", zap.String("initiative_id", string(i.ID)), zap.Error(err))
+	if info.CanManageUsersAndPortfolios {
+		portfolios, err := s.DB.PortfolioInitiativeMembershipsByInitiative(s.DB.NoTxn(ctx), i.ID)
+		if err != nil {
+			return nil, oapierr.Internal("failed to load portfolios for initiative", zap.String("initiative_id", string(i.ID)), zap.Error(err))
+		}
+		i.PortfolioInitiativeMemberships = portfolios
+		relationships, err := s.DB.InitiativeUserRelationshipsByInitiative(s.DB.NoTxn(ctx), i.ID)
+		if err != nil {
+			return nil, oapierr.Internal("failed to load initiative user relationships for initiative", zap.String("initiative_id", string(i.ID)), zap.Error(err))
+		}
+		i.InitiativeUserRelationships = relationships
+	} else if actorInfo.UserID != "" {
+		iur, err := s.DB.InitiativeUserRelationship(s.DB.NoTxn(ctx), i.ID, actorInfo.UserID)
+		if err != nil {
+			return nil, oapierr.Internal("failed to load singular initiative user relationship for initiative", zap.String("initiative_id", string(i.ID)), zap.Error(err))
+		}
+		i.InitiativeUserRelationships = []*pacta.InitiativeUserRelationship{iur}
+	}
+	if !info.CanSeeInternalInfo {
+		i.InternalDescription = ""
 	}
-	i.PortfolioInitiativeMemberships = portfolios
 	resp, err := conv.InitiativeToOAPI(i)
 	if err != nil {
 		return nil, err
@@ -144,6 +164,9 @@ func (s *Server) ListInitiatives(ctx context.Context, request api.ListInitiative
 	if err != nil {
 		return nil, oapierr.Internal("failed to load all initiatives", zap.Error(err))
 	}
+	for _, i := range is {
+		i.InternalDescription = ""
+	}
 	result, err := dereference(mapAll(is, conv.InitiativeToOAPI))
 	if err != nil {
 		return nil, err
@@ -158,17 +181,14 @@ func (s *Server) AllInitiativeData(ctx context.Context, request api.AllInitiativ
 	if err != nil {
 		return nil, err
 	}
-	// TODO(#12) Implement Authorization, along the lines of #121
-	i, err := s.DB.Initiative(s.DB.NoTxn(ctx), pacta.InitiativeID(request.Id))
+	id := pacta.InitiativeID(request.Id)
+	_, err = s.initiativeDoAuthzAndAuditLog(ctx, id, pacta.AuditLogAction_Download)
 	if err != nil {
-		if db.IsNotFound(err) {
-			return nil, oapierr.NotFound("initiative not found", zap.String("initiative_id", request.Id))
-		}
-		return nil, oapierr.Internal("failed to load initiative", zap.String("initiative_id", request.Id), zap.Error(err))
+		return nil, err
 	}
-	portfolioMembers, err := s.DB.PortfolioInitiativeMembershipsByInitiative(s.DB.NoTxn(ctx), i.ID)
+	portfolioMembers, err := s.DB.PortfolioInitiativeMembershipsByInitiative(s.DB.NoTxn(ctx), id)
 	if err != nil {
-		return nil, oapierr.Internal("failed to load portfolio memberships for initiative", zap.String("initiative_id", string(i.ID)), zap.Error(err))
+		return nil, oapierr.Internal("failed to load portfolio memberships for initiative", zap.String("initiative_id", string(id)), zap.Error(err))
 	}
 	portfolioIDs := []pacta.PortfolioID{}
 	for _, pm := range portfolioMembers {
@@ -176,7 +196,7 @@ func (s *Server) AllInitiativeData(ctx context.Context, request api.AllInitiativ
 	}
 	portfolios, err := s.DB.Portfolios(s.DB.NoTxn(ctx), portfolioIDs)
 	if err != nil {
-		return nil, oapierr.Internal("failed to load portfolios for initiative", zap.String("initiative_id", string(i.ID)), zap.Error(err))
+		return nil, oapierr.Internal("failed to load portfolios for initiative", zap.String("initiative_id", string(id)), zap.Error(err))
 	}
 	if err := s.populateBlobsInPortfolios(ctx, values(portfolios)...); err != nil {
 		return nil, err
@@ -192,7 +212,7 @@ func (s *Server) AllInitiativeData(ctx context.Context, request api.AllInitiativ
 			PrimaryTargetID:      string(p.ID),
 			PrimaryTargetOwner:   p.Owner,
 			SecondaryTargetType:  pacta.AuditLogTargetType_Initiative,
-			SecondaryTargetID:    string(i.ID),
+			SecondaryTargetID:    string(id),
 			SecondaryTargetOwner: &pacta.Owner{ID: "SYSTEM"}, // TODO(#12) When merging with #121, use the const type.
 		})
 	}
@@ -216,24 +236,30 @@ func (s *Server) AllInitiativeData(ctx context.Context, request api.AllInitiativ
 			ExpirationTime: expiryTime,
 		})
 	}
-
 	return api.AllInitiativeData200JSONResponse(response), nil
 }
 
-func (s *Server) initiativeDoAuthzAndAuditLog(ctx context.Context, iID pacta.InitiativeID, action pacta.AuditLogAction) error {
-	actorInfo, err := s.getActorInfoOrErrIfAnon(ctx)
-	if err != nil {
-		return err
-	}
-	iurs, err := s.DB.InitiativeUserRelationshipsByInitiative(s.DB.NoTxn(ctx), iID)
+type initiativeAuthzVisibilityInfo struct {
+	CanManageUsersAndPortfolios bool
+	CanSeeInternalInfo          bool
+}
+
+func (s *Server) initiativeDoAuthzAndAuditLog(ctx context.Context, iID pacta.InitiativeID, action pacta.AuditLogAction) (*initiativeAuthzVisibilityInfo, error) {
+	actorInfo, err := s.getActorInfoOrAnon(ctx)
 	if err != nil {
-		return oapierr.Internal("failed to list initiative user relationships", zap.Error(err))
+		return nil, err
 	}
 	userIsInitiativeManager := false
-	for _, iur := range iurs {
-		if iur.User.ID == actorInfo.UserID && iur.Manager {
-			userIsInitiativeManager = true
-			break
+	userIsInitiativeMember := false
+	if actorInfo.UserID != "" {
+		iur, err := s.DB.InitiativeUserRelationship(s.DB.NoTxn(ctx), iID, actorInfo.UserID)
+		if err != nil {
+			if !db.IsNotFound(err) {
+				return nil, oapierr.Internal("failed to find initiative user relationships", zap.Error(err))
+			}
+		} else {
+			userIsInitiativeMember = iur.Member
+			userIsInitiativeManager = iur.Manager
 		}
 	}
 	as := &authzStatus{
@@ -244,7 +270,16 @@ func (s *Server) initiativeDoAuthzAndAuditLog(ctx context.Context, iID pacta.Ini
 		action:               action,
 	}
 	switch action {
-	case pacta.AuditLogAction_Delete, pacta.AuditLogAction_Create, pacta.AuditLogAction_ReadMetadata, pacta.AuditLogAction_Update:
+	case pacta.AuditLogAction_ReadMetadata:
+		as.isAuthorized = true
+		if userIsInitiativeManager {
+			as.authorizedAsActorType = ptr(pacta.AuditLogActorType_Owner)
+		} else if actorInfo.IsAdmin || actorInfo.IsSuperAdmin {
+			as.authorizedAsActorType = ptr(pacta.AuditLogActorType_Admin)
+		} else {
+			as.authorizedAsActorType = ptr(pacta.AuditLogActorType_Public)
+		}
+	case pacta.AuditLogAction_Delete, pacta.AuditLogAction_Create, pacta.AuditLogAction_Update:
 		if userIsInitiativeManager {
 			as.authorizedAsActorType = ptr(pacta.AuditLogActorType_Owner)
 			as.isAuthorized = true
@@ -252,7 +287,13 @@ func (s *Server) initiativeDoAuthzAndAuditLog(ctx context.Context, iID pacta.Ini
 			as.isAuthorized, as.authorizedAsActorType = allowIfAdmin(actorInfo)
 		}
 	default:
-		return fmt.Errorf("unknown action %q for initiative authz", action)
+		return nil, fmt.Errorf("unknown action %q for initiative authz", action)
+	}
+	if err := s.auditLogIfAuthorizedOrFail(ctx, as); err != nil {
+		return nil, err
 	}
-	return s.auditLogIfAuthorizedOrFail(ctx, as)
+	return &initiativeAuthzVisibilityInfo{
+		CanSeeInternalInfo:          userIsInitiativeMember || userIsInitiativeManager || actorInfo.IsAdmin || actorInfo.IsSuperAdmin,
+		CanManageUsersAndPortfolios: userIsInitiativeManager || actorInfo.IsAdmin || actorInfo.IsSuperAdmin,
+	}, nil
 }
diff --git a/cmd/server/pactasrv/initiative_user_relationship.go b/cmd/server/pactasrv/initiative_user_relationship.go
index 9cd64ec..c951125 100644
--- a/cmd/server/pactasrv/initiative_user_relationship.go
+++ b/cmd/server/pactasrv/initiative_user_relationship.go
@@ -30,43 +30,9 @@ func (s *Server) ListInitiativeUserRelationshipsByUser(ctx context.Context, requ
 	return api.ListInitiativeUserRelationshipsByUser200JSONResponse(result), nil
 }
 
-// Returns all initiative user relationships for the initiative that the user has access to view
-// (GET /initiative/user-relationships/{id})
-func (s *Server) ListInitiativeUserRelationshipsByInitiative(ctx context.Context, request api.ListInitiativeUserRelationshipsByInitiativeRequestObject) (api.ListInitiativeUserRelationshipsByInitiativeResponseObject, error) {
-	id := pacta.InitiativeID(request.InitiativeId)
-	if err := s.initiativeDoAuthzAndAuditLog(ctx, id, pacta.AuditLogAction_ReadMetadata); err != nil {
-		return nil, err
-	}
-	iurs, err := s.DB.InitiativeUserRelationshipsByInitiative(s.DB.NoTxn(ctx), id)
-	if err != nil {
-		return nil, oapierr.Internal("failed to retrieve initiative user relationships by user", zap.Error(err))
-	}
-	result, err := dereference(mapAll(iurs, conv.InitiativeUserRelationshipToOAPI))
-	if err != nil {
-		return nil, err
-	}
-	return api.ListInitiativeUserRelationshipsByInitiative200JSONResponse(result), nil
-}
-
-// Returns the initiative user relationship from this id, if it exists
-// (GET /initiative/{initiativeId}/user-relationship/{userId})
-func (s *Server) GetInitiativeUserRelationship(ctx context.Context, request api.GetInitiativeUserRelationshipRequestObject) (api.GetInitiativeUserRelationshipResponseObject, error) {
-	// TODO(#12) Implement Authorization
-	iur, err := s.DB.InitiativeUserRelationship(s.DB.NoTxn(ctx), pacta.InitiativeID(request.InitiativeId), pacta.UserID(request.UserId))
-	if err != nil {
-		return nil, oapierr.Internal("failed to retrieve initiative user relationship", zap.Error(err))
-	}
-	result, err := conv.InitiativeUserRelationshipToOAPI(iur)
-	if err != nil {
-		return nil, err
-	}
-	return api.GetInitiativeUserRelationship200JSONResponse(*result), nil
-}
-
 // Updates initiative user relationship properties
 // (PATCH /initiative/{initiativeId}/user-relationship/{userId})
 func (s *Server) UpdateInitiativeUserRelationship(ctx context.Context, request api.UpdateInitiativeUserRelationshipRequestObject) (api.UpdateInitiativeUserRelationshipResponseObject, error) {
-	// TODO(#12) Implement Authorization
 	iID := pacta.InitiativeID(request.InitiativeId)
 	uID := pacta.UserID(request.UserId)
 	mutations := []db.UpdateInitiativeUserRelationshipFn{}
diff --git a/frontend/components/initiative/Toolbar.vue b/frontend/components/initiative/Toolbar.vue
deleted file mode 100644
index e1fe82d..0000000
--- a/frontend/components/initiative/Toolbar.vue
+++ /dev/null
@@ -1,76 +0,0 @@
-<script setup lang="ts">
-import { type InitiativeUserRelationship } from '@/openapi/generated/pacta'
-
-const localePath = useLocalePath()
-const { t } = useI18n()
-const { getMaybeMe } = useSession()
-const { isAdmin, maybeMe } = await getMaybeMe()
-
-const prefix = 'components/initiative/Toolbar'
-const tt = (key: string) => t(`${prefix}.${key}`)
-
-interface Props {
-  initiativeId: string
-  initiativeUserRelationships: InitiativeUserRelationship[]
-}
-const props = defineProps<Props>()
-
-const isManager = computed(() => {
-  const mm = maybeMe.value
-  return (!!mm && props.initiativeUserRelationships.some(r => r.manager && r.userId === mm.id))
-})
-const isMember = computed(() => {
-  const mm = maybeMe.value
-  return !!mm && props.initiativeUserRelationships.some(r => r.member && r.userId === mm.id)
-})
-const canEdit = computed<boolean>(() => isManager.value || isAdmin.value)
-const canSeeInternal = computed<boolean>(() => isManager.value || isMember.value || isAdmin.value)
-const showToolbar = computed<boolean>(() => canSeeInternal.value || canEdit.value)
-</script>
-
-<template>
-  <div
-    v-show="showToolbar"
-    class="p-buttonset initiative-toolbar"
-  >
-    <LinkButton
-      :to="localePath(`/initiative/${initiativeId}`)"
-      :label="tt('Initiative Home')"
-      icon="pi pi-home"
-      active-class="border-2"
-      inactive-class="p-button-outlined"
-    />
-    <LinkButton
-      v-if="canEdit"
-      :to="localePath(`/initiative/${initiativeId}/edit`)"
-      :label="tt('Edit')"
-      icon="pi pi-pencil"
-      active-class="border-2"
-      inactive-class="p-button-outlined"
-    />
-    <LinkButton
-      v-if="canEdit"
-      :to="localePath(`/initiative/${initiativeId}/invitations`)"
-      :label="tt('Invitations')"
-      icon="pi pi-envelope"
-      active-class="border-2"
-      inactive-class="p-button-outlined"
-    />
-    <LinkButton
-      v-if="canEdit"
-      :to="localePath(`/initiative/${initiativeId}/relationships`)"
-      :label="tt('Relationships')"
-      icon="pi pi-users"
-      active-class="border-2"
-      inactive-class="p-button-outlined"
-    />
-    <LinkButton
-      v-if="canSeeInternal"
-      :to="localePath(`/initiative/${initiativeId}/internal`)"
-      :label="tt('Internal Information')"
-      icon="pi pi-info-circle"
-      active-class="border-2"
-      inactive-class="p-button-outlined"
-    />
-  </div>
-</template>
diff --git a/frontend/composables/useInitiativeData.ts b/frontend/composables/useInitiativeData.ts
new file mode 100644
index 0000000..d9a68de
--- /dev/null
+++ b/frontend/composables/useInitiativeData.ts
@@ -0,0 +1,53 @@
+import { type InitiativeUserRelationship, type InitiativeInvitation } from '@/openapi/generated/pacta'
+
+export const useInitiativeData = async (id: string) => {
+  const prefix = `useInitiativeData[${id}]`
+
+  const pactaClient = usePACTA()
+  const { getMaybeMe } = useSession()
+
+  const { maybeMe, isAdmin, isSuperAdmin } = await getMaybeMe()
+
+  const meRelationships = useState<InitiativeUserRelationship[]>(`${prefix}.meRelationships`, () => [])
+  if (maybeMe.value) {
+    meRelationships.value = await pactaClient.listInitiativeUserRelationshipsByUser(maybeMe.value.id)
+  }
+
+  const isManagerByMe = computed(() => meRelationships.value.some((r) => r.initiativeId === id && r.manager))
+
+  const canManageByMe = computed(() => isAdmin.value || isSuperAdmin.value || isManagerByMe.value)
+
+  const maybeLookUpInvitationsByInitiative = async (): Promise<InitiativeInvitation[]> => {
+    if (!canManageByMe.value) {
+      return []
+    }
+    return await pactaClient.listInitiativeInvitations(id)
+  }
+
+  const [
+    { data: initiative, refresh: refreshInitiative },
+    { data: invitations, refresh: refreshInvitations },
+  ] = await Promise.all([
+    useSimpleAsyncData(`${prefix}.getInitiative`, () => pactaClient.findInitiativeById(id)),
+    useSimpleAsyncData(`${prefix}.getInvitations`, maybeLookUpInvitationsByInitiative),
+  ])
+
+  const isMember = computed(() => initiative.value.initiativeUserRelationships.some((r) => r.member))
+  const isManager = computed(() => initiative.value.initiativeUserRelationships.some((r) => r.manager))
+  const canManage = computed(() => canManageByMe.value || isManager.value)
+
+  const canJoinIfLoggedIn = computed(() => !isMember.value && !isManager.value && initiative.value.isAcceptingNewMembers && !initiative.value.requiresInvitationToJoin)
+  const canDirectlyJoin = computed(() => canJoinIfLoggedIn.value && maybeMe.value)
+
+  return {
+    initiative,
+    refreshInitiative,
+    invitations,
+    refreshInvitations,
+    canManage,
+    isMember,
+    isManager,
+    canDirectlyJoin,
+    canJoinIfLoggedIn,
+  }
+}
diff --git a/frontend/composables/usePACTA.ts b/frontend/composables/usePACTA.ts
index e719274..03d0c8f 100644
--- a/frontend/composables/usePACTA.ts
+++ b/frontend/composables/usePACTA.ts
@@ -30,7 +30,7 @@ export const usePACTA = () => {
   // interface of our auto-generated code, which expects a class that extends
   // BaseHttpRequest.
   const httpReqClass = class extends BaseHttpRequest {
-    private readonly getToken: () => Promise<AuthenticationResult>
+    private readonly getToken: () => Promise<AuthenticationResult | undefined>
 
     constructor (config: OpenAPIConfig) {
       super(config)
diff --git a/frontend/lang/en.json b/frontend/lang/en.json
index cce1a68..ddb795e 100644
--- a/frontend/lang/en.json
+++ b/frontend/lang/en.json
@@ -68,7 +68,9 @@
     "AuditLogsHelpText": "Audit logs are a record of who has accessed or modified this analysis, and when. This is useful for debugging, for understanding who has seen this analysis, and for establishing peace of mind that your data's security is being upheld.",
     "View Audit Logs": "View Audit Logs"
   },
-  "components/initiative/Toolbar": {
+  "pages/initiative": {
+    "Initiative": "Initiative",
+    "Portfolios": "Portfolios",
     "Edit": "Edit",
     "Initiative Home": "Initiative Home",
     "Internal Information": "Internal Information",
diff --git a/frontend/lib/editor/initiative.ts b/frontend/lib/editor/initiative.ts
index cccd077..1bf254d 100644
--- a/frontend/lib/editor/initiative.ts
+++ b/frontend/lib/editor/initiative.ts
@@ -71,6 +71,10 @@ const createEditorInitiativeFields = (translation: Translation): EditorInitiativ
       name: 'portfolioInitiativeMemberships',
       label: tt('Portfolio Initiative Memberships'),
     },
+    initiativeUserRelationships: {
+      name: 'initiativeUserRelationships',
+      label: tt('Initiative User Relationships'),
+    },
   }
 }
 
diff --git a/frontend/openapi/generated/pacta/models/Initiative.ts b/frontend/openapi/generated/pacta/models/Initiative.ts
index a1cca61..47a82cf 100644
--- a/frontend/openapi/generated/pacta/models/Initiative.ts
+++ b/frontend/openapi/generated/pacta/models/Initiative.ts
@@ -3,6 +3,7 @@
 /* tslint:disable */
 /* eslint-disable */
 
+import type { InitiativeUserRelationship } from './InitiativeUserRelationship';
 import type { Language } from './Language';
 import type { PortfolioInitiativeMembershipPortfolio } from './PortfolioInitiativeMembershipPortfolio';
 
@@ -51,6 +52,10 @@ export type Initiative = {
      * the list of portfolios that are members of this initiative
      */
     portfolioInitiativeMemberships: Array<PortfolioInitiativeMembershipPortfolio>;
+    /**
+     * the list of users that are members of this initiative
+     */
+    initiativeUserRelationships: Array<InitiativeUserRelationship>;
     /**
      * The time at which this initiative was created.
      */
diff --git a/frontend/openapi/generated/pacta/services/DefaultService.ts b/frontend/openapi/generated/pacta/services/DefaultService.ts
index 05c2297..4d1bbcb 100644
--- a/frontend/openapi/generated/pacta/services/DefaultService.ts
+++ b/frontend/openapi/generated/pacta/services/DefaultService.ts
@@ -305,24 +305,6 @@ export class DefaultService {
         });
     }
 
-    /**
-     * Returns all initiative user relationships for this initiative that the caller has access to view
-     * @param initiativeId ID of the initiative to fetch relationships for
-     * @returns InitiativeUserRelationship
-     * @throws ApiError
-     */
-    public listInitiativeUserRelationshipsByInitiative(
-        initiativeId: string,
-    ): CancelablePromise<Array<InitiativeUserRelationship>> {
-        return this.httpRequest.request({
-            method: 'GET',
-            url: '/initiative/{initiativeId}/user-relationships',
-            path: {
-                'initiativeId': initiativeId,
-            },
-        });
-    }
-
     /**
      * Returns all initiative user relationships for this user that the caller has access to view
      * @param userId ID of the user to fetch relationships for
@@ -435,27 +417,6 @@ export class DefaultService {
         });
     }
 
-    /**
-     * Returns the initiative user relationship from this id, if it exists
-     * @param initiativeId ID of the initiative
-     * @param userId ID of the user
-     * @returns InitiativeUserRelationship
-     * @throws ApiError
-     */
-    public getInitiativeUserRelationship(
-        initiativeId: string,
-        userId: string,
-    ): CancelablePromise<InitiativeUserRelationship> {
-        return this.httpRequest.request({
-            method: 'GET',
-            url: '/initiative/{initiativeId}/user-relationship/{userId}',
-            path: {
-                'initiativeId': initiativeId,
-                'userId': userId,
-            },
-        });
-    }
-
     /**
      * Updates initiative user relationship properties
      * Updates a given user's relationship properties for a given initiative
diff --git a/frontend/pages/admin/initiative/new.vue b/frontend/pages/admin/initiative/new.vue
index 1141b1b..b0a5dec 100644
--- a/frontend/pages/admin/initiative/new.vue
+++ b/frontend/pages/admin/initiative/new.vue
@@ -23,6 +23,7 @@ const defaultInitiative = {
   pactaVersion: undefined,
   createdAt: '',
   portfolioInitiativeMemberships: [],
+  initiativeUserRelationships: [],
 }
 const {
   editorFields,
diff --git a/frontend/pages/initiative/[id].vue b/frontend/pages/initiative/[id].vue
index 8fd69b4..921f4c6 100644
--- a/frontend/pages/initiative/[id].vue
+++ b/frontend/pages/initiative/[id].vue
@@ -1,33 +1,82 @@
 <script setup lang="ts">
-const pactaClient = usePACTA()
 const { fromParams } = useURLParams()
+const { t } = useI18n()
+const localePath = useLocalePath()
+
+const tt = (key: string) => t(`pages/initiative.${key}`)
 
 const id = presentOrCheckURL(fromParams('id'))
-const prefix = `initiative/${id}/invitations`
-const [
-  { data: initiative },
-  { data: relationships },
-] = await Promise.all([
-  useSimpleAsyncData(`${prefix}.getInitiative`, () => pactaClient.findInitiativeById(id)),
-  useSimpleAsyncData(`${prefix}.getRelationships`, () => pactaClient.listInitiativeUserRelationshipsByInitiative(id)),
-])
+const { initiative, canManage, isMember } = await useInitiativeData(id)
+
+const menuItems = computed((): Array<{ to: string, label: string, icon: string }> => {
+  if (!canManage.value && !isMember.value) {
+    return []
+  }
+  const result = [
+    {
+      to: localePath(`/initiative/${id}`),
+      label: tt('Initiative Home'),
+      icon: 'pi pi-home',
+    },
+  ]
+  if (canManage.value) {
+    result.push(
+      {
+        to: localePath(`/initiative/${id}/edit`),
+        label: tt('Edit'),
+        icon: 'pi pi-pencil',
+      },
+      {
+        to: localePath(`/initiative/${id}/invitations`),
+        label: tt('Invitations'),
+        icon: 'pi pi-envelope',
+      },
+      {
+        to: localePath(`/initiative/${id}/relationships`),
+        label: tt('Relationships'),
+        icon: 'pi pi-users',
+      },
+      {
+        to: localePath(`/initiative/${id}/portfolios`),
+        label: tt('Portfolios'),
+        icon: 'pi pi-copy',
+      },
+    )
+  }
+  if (canManage.value || isMember.value) {
+    result.push(
+      {
+        to: localePath(`/initiative/${id}/internal`),
+        label: tt('Internal Information'),
+        icon: 'pi pi-info-circle',
+      },
+    )
+  }
+  return result
+})
 </script>
 
 <template>
   <StandardContent v-if="initiative">
-    <TitleBar :title="`Initiative: ${initiative.name}`" />
-    <InitiativeToolbar
-      :initiative-id="initiative.id"
-      :initiative-user-relationships="relationships"
-    />
+    <TitleBar :title="`${tt('Initiative')}: ${initiative.name}`" />
+    <div
+      v-if="menuItems.length > 0"
+      class="p-buttonset"
+    >
+      <LinkButton
+        v-for="item in menuItems"
+        :key="item.to"
+        :to="item.to"
+        :label="item.label"
+        :icon="item.icon"
+        active-class="border-2"
+        inactive-class="p-button-outlined"
+      />
+    </div>
     <NuxtPage />
     <StandardDebug
       :value="initiative"
       label="Initiative"
     />
-    <StandardDebug
-      :value="relationships"
-      label="Relationships"
-    />
   </StandardContent>
 </template>
diff --git a/frontend/pages/initiative/[id]/edit.vue b/frontend/pages/initiative/[id]/edit.vue
index d8d7dac..94c1674 100644
--- a/frontend/pages/initiative/[id]/edit.vue
+++ b/frontend/pages/initiative/[id]/edit.vue
@@ -12,15 +12,17 @@ const { t } = i18n
 const id = presentOrCheckURL(fromParams('id'))
 
 const prefix = `pages/initiative/${id}`
-const { data } = await useSimpleAsyncData(`${prefix}.getInitiative`, () => pactaClient.findInitiativeById(id))
+
+const { initiative } = await useInitiativeData(id)
+
 const {
   editorValues,
   editorFields,
   changes,
   saveTooltip,
   canSave,
-} = initiativeEditor(presentOrCheckURL(data.value, 'no initiative in response'), i18n)
-const tt = (key: string) => t(`pages/initiative/id.${key}`)
+} = initiativeEditor(presentOrCheckURL(initiative.value, 'no initiative in response'), i18n)
+const tt = (key: string) => t(`pages/initiative/id/edit.${key}`)
 
 const deleteInitiative = () => withLoading(
   () => pactaClient.deleteInitiative(id)
diff --git a/frontend/pages/initiative/[id]/index.vue b/frontend/pages/initiative/[id]/index.vue
index 41953ce..b70817d 100644
--- a/frontend/pages/initiative/[id]/index.vue
+++ b/frontend/pages/initiative/[id]/index.vue
@@ -5,19 +5,14 @@ const pactaClient = usePACTA()
 const { fromParams } = useURLParams()
 const { humanReadableDateFromStandardString } = useTime()
 const { getMaybeMe } = useSession()
+const { signIn } = useSignIn()
 const { loading: { withLoading } } = useModal()
 
 const { maybeMe } = await getMaybeMe()
 
 const id = presentOrCheckURL(fromParams('id'))
-const prefix = `initiative/${id}`
-const [
-  { data: initiative },
-  { data: relationships, refresh: refreshRelationships },
-] = await Promise.all([
-  useSimpleAsyncData(`${prefix}.getInitiative`, () => pactaClient.findInitiativeById(id)),
-  useSimpleAsyncData(`${prefix}.getRelationships`, () => pactaClient.listInitiativeUserRelationshipsByInitiative(id)),
-])
+
+const { initiative, refreshInitiative, canDirectlyJoin, isMember, canJoinIfLoggedIn } = await useInitiativeData(id)
 
 const status = computed(() => {
   const i = initiative.value
@@ -31,15 +26,6 @@ const status = computed(() => {
   }
 })
 
-const isAMember = computed(() => {
-  const mm = maybeMe.value
-  if (!mm) return false
-  return relationships.value.some((r) => r.userId === mm.id && r.member)
-})
-const canJoin = computed(() => {
-  const i = initiative.value
-  return maybeMe.value && i.isAcceptingNewMembers && !i.requiresInvitationToJoin && !isAMember.value
-})
 const join = () => {
   void withLoading(async () => {
     await pactaClient.updateInitiativeUserRelationship(
@@ -47,7 +33,7 @@ const join = () => {
       presentOrFileBug(maybeMe.value).id,
       { member: true },
     )
-    await refreshRelationships()
+    await refreshInitiative()
   }, 'initiative/join')
 }
 </script>
@@ -75,24 +61,31 @@ const join = () => {
     </div>
     {{ initiative.publicDescription }}
     <PVButton
-      v-if="isAMember"
+      v-if="isMember"
       disabled
       label="You are a member of this initiative"
       icon="pi pi-check"
     />
     <PVButton
-      v-if="isAMember"
+      v-if="isMember"
       label="Leave Initiative"
       icon="pi pi-arrow-left"
       class="p-button-danger p-button-outlined"
     />
     <PVButton
-      v-if="canJoin"
+      v-if="canDirectlyJoin"
       label="Join Initiative"
       icon="pi pi-arrow-right"
       icon-pos="right"
       @click="join"
     />
+    <PVButton
+      v-if="canJoinIfLoggedIn"
+      label="Sign in or Create Account to Participate"
+      icon="pi pi-arrow-right"
+      icon-pos="right"
+      @click="signIn"
+    />
     <StandardDebug
       :value="initiative"
       label="Initiative"
diff --git a/frontend/pages/initiative/[id]/internal.vue b/frontend/pages/initiative/[id]/internal.vue
index 3a7f0e8..a684688 100644
--- a/frontend/pages/initiative/[id]/internal.vue
+++ b/frontend/pages/initiative/[id]/internal.vue
@@ -1,16 +1,9 @@
 <script setup lang="ts">
-const pactaClient = usePACTA()
 const { fromParams } = useURLParams()
 
 const id = presentOrCheckURL(fromParams('id'))
-const prefix = `initiative/${id}/invitations`
-const [
-  { data: initiative },
-] = await Promise.all([
-  useSimpleAsyncData(`${prefix}.getInitiative`, () => pactaClient.findInitiativeById(id)),
-  useSimpleAsyncData(`${prefix}.getInvitations`, () => pactaClient.listInitiativeInvitations(id)),
-  useSimpleAsyncData(`${prefix}.getRelationships`, () => pactaClient.listInitiativeUserRelationshipsByInitiative(id)),
-])
+
+const { initiative } = await useInitiativeData(id)
 </script>
 
 <template>
diff --git a/frontend/pages/initiative/[id]/invitations.vue b/frontend/pages/initiative/[id]/invitations.vue
index 3a71446..27a4abc 100644
--- a/frontend/pages/initiative/[id]/invitations.vue
+++ b/frontend/pages/initiative/[id]/invitations.vue
@@ -18,13 +18,7 @@ const rawNewInvitations = useState<string>(`${prefix}.rawNewInvitations`, () =>
 const numToRandomize = useState<number>(`${prefix}.numToRandomize`, () => 5)
 const dataTable = useState<DataTable>(`${prefix}.dataTable`)
 
-const [
-  { data: initiative },
-  { data: invitations, refresh: refreshInvitations },
-] = await Promise.all([
-  useSimpleAsyncData(`${prefix}.getInitiative`, () => pactaClient.findInitiativeById(id)),
-  useSimpleAsyncData(`${prefix}.getInvitations`, () => pactaClient.listInitiativeInvitations(id)),
-])
+const { initiative, invitations, refreshInitiative, refreshInvitations } = await useInitiativeData(id)
 
 const newInvitations = computed(() => {
   const raw = rawNewInvitations.value
@@ -70,13 +64,13 @@ const createInvitations = () => {
   })).map((request) => pactaClient.createInitiativeInvitation(request))
   return withLoading(
     () => Promise.all(requests)
-      .then(refreshInvitations)
+      .then(refreshInitiative)
       .then(() => { createModalVisible.value = false }),
     `${prefix}.createInvitations`,
   )
 }
 const deleteInvitation = (id: string) => withLoading(
-  () => pactaClient.deleteInitiativeInvitation(id).then(refreshInvitations),
+  () => pactaClient.deleteInitiativeInvitation(id).then(refreshInitiative),
   `${prefix}.deleteInvitation`,
 )
 const deleteAll = () => withLoading(
diff --git a/frontend/pages/initiative/[id]/relationships.vue b/frontend/pages/initiative/[id]/relationships.vue
index eaabd2b..5d5107a 100644
--- a/frontend/pages/initiative/[id]/relationships.vue
+++ b/frontend/pages/initiative/[id]/relationships.vue
@@ -1,36 +1,17 @@
 <script setup lang="ts">
 
 const { fromParams } = useURLParams()
+const id = presentOrCheckURL(fromParams('id'))
 const localePath = useLocalePath()
 const { humanReadableTimeFromStandardString } = useTime()
 const { loading: { withLoading } } = useModal()
 const { t } = useI18n()
+const pactaClient = usePACTA()
+const { initiative, refreshInitiative, canManage } = await useInitiativeData(id)
 
 const tt = (key: string) => t(`pages/initiative/relationships.${key}`)
 
-const [
-  pactaClient,
-  { getMaybeMe },
-] = await Promise.all([
-  usePACTA(),
-  useSession(),
-])
-const { maybeMe, isAdmin } = await getMaybeMe()
-
-const id = presentOrCheckURL(fromParams('id'))
-const prefix = `initiative/${id}/relationships`
-const [
-  { data: relationships, refresh: refreshRelationships },
-] = await Promise.all([
-  useSimpleAsyncData(`${prefix}.getRelationships`, () => pactaClient.listInitiativeUserRelationshipsByInitiative(id)),
-])
-const nonEmptyRelationships = computed(() => relationships.value.filter((r) => r.manager || r.member))
-const canManage = computed(() => {
-  const mm = maybeMe.value
-  if (!mm) return false
-  if (isAdmin.value) return true
-  return relationships.value.some((r) => r.userId === mm.id && r.manager)
-})
+const nonEmptyRelationships = computed(() => initiative.value.initiativeUserRelationships.filter((r) => r.manager || r.member))
 
 const changeMembership = (userId: string, member: boolean | undefined, manager: boolean | undefined) =>
   withLoading(async () => {
@@ -39,7 +20,7 @@ const changeMembership = (userId: string, member: boolean | undefined, manager:
       userId,
       { member, manager },
     )
-    await refreshRelationships()
+    await refreshInitiative()
   }, 'initiative/relationships/changeMembership')
 
 const addManager = (userId: string) => { void changeMembership(userId, undefined, true) }
diff --git a/frontend/plugins/msal.ts b/frontend/plugins/msal.ts
index b5ed040..ae8efe0 100644
--- a/frontend/plugins/msal.ts
+++ b/frontend/plugins/msal.ts
@@ -248,10 +248,9 @@ export default defineNuxtPlugin(async (_nuxtApp) => {
     return filteredAccounts[0]
   })
 
-  const getToken = () => {
+  const getToken = (): Promise<AuthenticationResult | undefined> => {
     if (account.value === undefined) {
-      // TODO: Figure out if this is a legitimate usecase.
-      return Promise.reject(new Error('tried to get a token, but no account was found'))
+      return new Promise<AuthenticationResult | undefined>((resolve) => { resolve(undefined) })
     }
 
     const request: SilentRequest = {
@@ -282,18 +281,16 @@ export default defineNuxtPlugin(async (_nuxtApp) => {
       })
   }
 
-  const createAPIKey = (): Promise<APIKey> => {
-    return getToken()
-      .then((response) => {
-        const userClient = userClientWithAuth(response.idToken)
-        return userClient.createApiKey()
-      })
-      .then((resp) => {
-        if ('message' in resp) {
-          throw new Error(`error creating a new API key ${resp.message}`)
-        }
-        return resp
-      })
+  const createAPIKey = async (): Promise<APIKey | undefined> => {
+    const token = await getToken()
+    if (!token) {
+      return undefined
+    }
+    const apiKey = await userClientWithAuth(token.idToken).createApiKey()
+    if ('message' in apiKey) {
+      throw new Error(`error creating a new API key ${apiKey.message}`)
+    }
+    return apiKey
   }
 
   return {
diff --git a/openapi/pacta.yaml b/openapi/pacta.yaml
index a703956..2a3757b 100644
--- a/openapi/pacta.yaml
+++ b/openapi/pacta.yaml
@@ -253,25 +253,6 @@ paths:
       responses:
         '204':
           description: initiative created successfully
-  /initiative/{initiativeId}/user-relationships:
-    get:
-      summary: Returns all initiative user relationships for this initiative that the caller has access to view
-      operationId: listInitiativeUserRelationshipsByInitiative
-      parameters:
-        - name: initiativeId
-          in: path
-          description: ID of the initiative to fetch relationships for
-          required: true
-          schema:
-            type: string
-      responses:
-        '200':
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/InitiativeUserRelationship'
   /initiative/user-relationships/{userId}:
     get:
       summary: Returns all initiative user relationships for this user that the caller has access to view
@@ -372,28 +353,6 @@ paths:
         '204':
           description: initiative invitation deleted successfully
   /initiative/{initiativeId}/user-relationship/{userId}:
-    get:
-      summary: Returns the initiative user relationship from this id, if it exists
-      operationId: getInitiativeUserRelationship
-      parameters:
-        - name: initiativeId
-          in: path
-          description: ID of the initiative
-          required: true
-          schema:
-            type: string
-        - name: userId
-          in: path
-          description: ID of the user
-          required: true
-          schema:
-            type: string
-      responses:
-        '200':
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/InitiativeUserRelationship'
     patch:
       summary: Updates initiative user relationship properties
       description: Updates a given user's relationship properties for a given initiative
@@ -1275,6 +1234,7 @@ components:
         - language
         - createdAt
         - portfolioInitiativeMemberships
+        - initiativeUserRelationships
       properties:
         id:
           type: string
@@ -1311,6 +1271,11 @@ components:
           description: the list of portfolios that are members of this initiative
           items: 
             $ref: '#/components/schemas/PortfolioInitiativeMembershipPortfolio'
+        initiativeUserRelationships:
+          type: array
+          description: the list of users that are members of this initiative
+          items: 
+            $ref: '#/components/schemas/InitiativeUserRelationship'
         createdAt:
           type: string
           format: date-time
diff --git a/session/session.go b/session/session.go
index 4c22233..391229e 100644
--- a/session/session.go
+++ b/session/session.go
@@ -13,11 +13,18 @@ import (
 )
 
 var userIDKey = struct{}{}
+var allowedAnonymousKey = struct{}{}
+
+const allowedAnonymousValue = "allowedAnonymous"
 
 func WithUserID(c context.Context, id pacta.UserID) context.Context {
 	return context.WithValue(c, userIDKey, id)
 }
 
+func WithAllowedAnonymous(c context.Context) context.Context {
+	return context.WithValue(c, allowedAnonymousKey, allowedAnonymousValue)
+}
+
 type DB interface {
 	NoTxn(context.Context) db.Tx
 	UserByAuthn(tx db.Tx, mech pacta.AuthnMechanism, authnID string) (*pacta.User, error)
@@ -34,6 +41,18 @@ func UserIDFromContext(ctx context.Context) (pacta.UserID, error) {
 	return userID, nil
 }
 
+func IsAllowedAnonymous(ctx context.Context) bool {
+	v := ctx.Value(allowedAnonymousKey)
+	if v == nil {
+		return false
+	}
+	s, ok := v.(string)
+	if !ok {
+		return false
+	}
+	return s == allowedAnonymousValue
+}
+
 func WithAuthn(logger *zap.Logger, d DB) func(http.Handler) http.Handler {
 	fn := func(c context.Context) (context.Context, error) {
 		token, _, err := jwtauth.FromContext(c)

From 25da9c13984539387250f421a2a05bceca057bc1 Mon Sep 17 00:00:00 2001
From: Grady Ward <grady.b.ward@gmail.com>
Date: Wed, 24 Jan 2024 06:57:51 -0700
Subject: [PATCH 3/3] Addresses Review Comments

---
 cmd/server/main.go           | 29 ++++++++++++++++-------------
 cmd/server/pactasrv/authz.go | 21 ++++++++++-----------
 session/session.go           | 12 ++++++------
 3 files changed, 32 insertions(+), 30 deletions(-)

diff --git a/cmd/server/main.go b/cmd/server/main.go
index 6880cdd..728de4f 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -373,15 +373,25 @@ func run(args []string) error {
 	return nil
 }
 
-var publicEndpoints = []*regexp.Regexp{
-	regexp.MustCompile(`^/initiative/[^/]*$`),
+type allowFn func(r *http.Request) bool
+
+var publicEndpoints = []allowFn{
+	allowPublicInitiativeLookups,
+}
+
+var allowPublicInitiativeLookupsRegexp = regexp.MustCompile(`^/initiative/[^/]*$`)
+
+func allowPublicInitiativeLookups(r *http.Request) bool {
+	if r.Method != http.MethodGet {
+		return false
+	}
+	return allowPublicInitiativeLookupsRegexp.MatchString(r.URL.Path)
 }
 
 func requireJWTIfNotPublicEndpoint(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		path := r.URL.Path
-		for _, re := range publicEndpoints {
-			if re.MatchString(path) {
+		for _, fn := range publicEndpoints {
+			if fn(r) {
 				r = r.WithContext(session.WithAllowedAnonymous(r.Context()))
 				next.ServeHTTP(w, r)
 				return
@@ -402,14 +412,7 @@ func rateLimitMiddleware(maxReq int, windowLength time.Duration) func(http.Handl
 		httprate.WithKeyFuncs(func(r *http.Request) (string, error) {
 			if session.IsAllowedAnonymous(r.Context()) {
 				// Rate limit by IP address if the user is anonymous.
-				ip := r.Header.Get("X-Real-IP")
-				if ip == "" {
-					ip = r.Header.Get("X-Forwarded-For")
-				}
-				if ip == "" {
-					ip = r.RemoteAddr
-				}
-				return ip, nil
+				return r.RemoteAddr, nil
 			}
 			_, claims, err := jwtauth.FromContext(r.Context())
 			if err != nil {
diff --git a/cmd/server/pactasrv/authz.go b/cmd/server/pactasrv/authz.go
index d54a5b1..52ec74b 100644
--- a/cmd/server/pactasrv/authz.go
+++ b/cmd/server/pactasrv/authz.go
@@ -79,27 +79,26 @@ func notFoundOrUnauthorized[T ~string](actorInfo actorInfo, action pacta.AuditLo
 }
 
 func (s *Server) auditLogIfAuthorizedOrFail(ctx context.Context, status *authzStatus) error {
-	zapFields := []zap.Field{
-		zap.String("actor_id", status.actorUserID()),
-		zap.String("action", string(status.action)),
-		zap.String("target_type", string(status.primaryTargetType)),
-		zap.String("target_id", status.primaryTargetID),
+	zapFields := func(others ...zap.Field) []zap.Field {
+		return append([]zap.Field{
+			zap.String("actor_id", status.actorUserID()),
+			zap.String("action", string(status.action)),
+			zap.String("target_type", string(status.primaryTargetType)),
+			zap.String("target_id", status.primaryTargetID),
+		}, others...)
 	}
 	if !status.isAuthorized {
-		zapFields = append(zapFields, zap.String("reason", "is_authorized_false"))
-		s.Logger.Warn("not authorized", zapFields...)
+		s.Logger.Warn("not authorized", zapFields(zap.String("reason", "is_authorized_false"))...)
 		return notFoundOrUnauthorized(status.actorInfo, status.action, status.primaryTargetType, status.primaryTargetID)
 	}
 	al, err := status.ToAuditLog()
 	if err != nil {
-		zapFields = append(zapFields, zap.String("reason", "to_audit_log_failure"), zap.Error(err))
-		s.Logger.Warn("not authorized", zapFields...)
+		s.Logger.Warn("not authorized", zapFields(zap.String("reason", "to_audit_log_failure"), zap.Error(err))...)
 		return err
 	}
 	_, err = s.DB.CreateAuditLog(s.DB.NoTxn(ctx), al)
 	if err != nil {
-		zapFields = append(zapFields, zap.String("reason", "create_audit_log_failure"), zap.Error(err))
-		s.Logger.Warn("not authorized", zapFields...)
+		s.Logger.Warn("not authorized", zapFields(zap.String("reason", "create_audit_log_failure"), zap.Error(err))...)
 		return oapierr.Internal("creating audit log failed", zap.Error(err))
 	}
 	return nil
diff --git a/session/session.go b/session/session.go
index 391229e..a4efb68 100644
--- a/session/session.go
+++ b/session/session.go
@@ -12,17 +12,17 @@ import (
 	"go.uber.org/zap"
 )
 
-var userIDKey = struct{}{}
-var allowedAnonymousKey = struct{}{}
+type userIDKey = struct{}
+type allowedAnonymousKey = struct{}
 
 const allowedAnonymousValue = "allowedAnonymous"
 
 func WithUserID(c context.Context, id pacta.UserID) context.Context {
-	return context.WithValue(c, userIDKey, id)
+	return context.WithValue(c, userIDKey{}, id)
 }
 
 func WithAllowedAnonymous(c context.Context) context.Context {
-	return context.WithValue(c, allowedAnonymousKey, allowedAnonymousValue)
+	return context.WithValue(c, allowedAnonymousKey{}, allowedAnonymousValue)
 }
 
 type DB interface {
@@ -31,7 +31,7 @@ type DB interface {
 }
 
 func UserIDFromContext(ctx context.Context) (pacta.UserID, error) {
-	userID, ok := ctx.Value(userIDKey).(pacta.UserID)
+	userID, ok := ctx.Value(userIDKey{}).(pacta.UserID)
 	if !ok {
 		return "", oapierr.Unauthorized("no user id in context")
 	}
@@ -42,7 +42,7 @@ func UserIDFromContext(ctx context.Context) (pacta.UserID, error) {
 }
 
 func IsAllowedAnonymous(ctx context.Context) bool {
-	v := ctx.Value(allowedAnonymousKey)
+	v := ctx.Value(allowedAnonymousKey{})
 	if v == nil {
 		return false
 	}