a-stanisz / cinephile-diary Goto Github PK

Not sure if the decoded token (user data) needs additional ajv-validation since jwt.verify method is some kind of validation itself

User stories:

• basic-user/premium-user adds a new movie ✔
• basic-user tries to add a new movie while having the service usage limit already reached ✔
• basic-user/premium-user provides incorrect title (pass error info as a properly structured error response) ❌
• basic-user/premium-user provides a title that already exists in the database (do not duplicate entries - maybe use IMDb ID) ❌
• basic-user/premium-user gets the list of user's entries (filter movies array for only needed data, do not expose db-specific data) ❌

Solve 'TimeoutOverflowWarning' or use another solution, e.g. job scheduling with Redis (?).

Implement validation of requests payload.

Example solution: define JSON Schema for allowed payloads and use Ajv validator.

Edit 1:
What is to validate within the request payload:

• if decoded token taken from the request's auth header is the user data and complies with the user schema
• if the request's body complies with the movie schema and therefore doesn't consist of any excessive data

Edit 2:
Consider if the token even needs validation, while jwt.verify method is some kind of validation itself 🤔