Change Summary

• Permission: add permission matrix and implement permission check in api handler
• Permission: add test case to see if permission check working
• User: refactor code, inject user object into request so following handler can get user from context directly
• User: inject mock user in testApiHandler for test convenient, also add relative documentation
• Other: Optimize file path in test folder.

By the way, not all the endpoint is listed in the Repair Lab Permissions Matrix, may need to update the matrix.
https://docs.google.com/spreadsheets/d/18AxrBPgUUgtK0lcNLxSUmxFfxQERglB_L3c7OL6s9DE/edit#gid=1755505050

Change Form

Fill this up (NA if not available). If a certain criteria is not met, can you please give a reason.

• The pull request title has an issue number
• The change works by "Smoke testing" or quick testing
• The change has tests
• The change has documentation

Other Information

Future improvement

• merge page permission and api permission and automatically add permission check to endpoint with regexp.