/users/:id returned the requester profile not the user corresponding to the id

[manodupont]

I navigated through the code and couldn't help but notice those lines

const getUser: ViewFn = (instance, request) => {
  const { user: requestUser } = request;
  if (!requestUser) {
    return [403, "Access denied"];
  }

  return [
    200,
    {
      ...requestUser.profile,
      // TODO: make these configurable
      disableableCredentialTypes: ["password"],

...

So this means, the user returned is always the one who made the request, not the one corresponding to id in request param.

It should be the user in the databases, no ?
Otherwise its useless to have mocked this method.