decred / contractor-mgmt Goto Github PK

Restrict attachments to image/jpeg and image/png. This depends on decred/politeia#644.

This is a full list of requirements set for the initial release:

Components:

• CLI to interact with the web server
• DB util to interact directly with the web server's database
• Web server which has a user database and stores invoices in Politeiad

Features:

• General:
  • User accounts
    • Registration by invite code only, received via email
      • Prompt for: username, username (again), password, password (again), first name, last name, location, extended pubkey
    • Login & logout
      • Automatic account locking after too many failed login attempts
    • Manage user account to set/change:
      • Username
      • Password
      • Identity
      • Name
      • Location
      • Extended pubkey for payments
  • Invoices
    • Submitted by contractor users, stored in Politead
    • Viewable only by contractor who submitted them and admin users
    • Require a specific, parseable format with the following information:
      • Month/Year
      • Summary of work
      • Type of work
      • Link to Politeia Proposal
      • Hours spent
      • Cost
    • Ensure that the submitted format contains the Month and Year within a comment
    • 5 states:
      • Unreviewed
      • Rejected
      • UnreviewedChanges
      • Approved
      • Paid
  • Send verification emails to users (for registration, updating user info, etc)
• System admins:
  • Create new users directly in the database, bypassing the registration process
• Contractor users:
  • Submit new invoices
  • Submit edits to invoices that are rejected
  • View all previously submitted invoices and their statuses
• Admin users:
  • Invite users by email to become contractors
  • View all users, filterable by email or username
  • View user details
  • Edit user details:
    • Resend invite token
    • Expire update identity verification token
    • Lock / unlock users from logging in (require a reason for locking, unlocking reason is optional)
  • View all submitted invoices, filterable by status and month
  • Approve invoices
  • Reject invoices (require a reason)
  • Manually mark invoices as paid
  • Ability to export all approved invoices by month, including:
    • The month's DCR/USD exchange rate
    • List of addresses generated from the users' extended pubkeys
    • A process which watches the blockchain for payment transactions to an address, automatically updating the invoice state as Paid
• Testing & docs:
  • End-to-end tests that test various responses from the server by utilizing the dataload and cli tools
  • API documentation for the server

The api.md has not been updated since it was copied from Politeia, so it has a lot of incorrect information. It needs to be fully updated to reflect the current routes offered by cmswww.

The userPubkeys cache should be moved into a database table, and new pubkey-related functions, like AddPubkeyForUser() and GetUserByPubkey(), should be added for interacting with them.

Allow administrators to comment on specific invoices and allow the user that submitted the invoice to see the comments as well.

• Add the ability to delete attachment files via an invoice edit.
• Add an attachment to an invoice and remove it in an edit via dataload test.

1. larger box for description
2. allow entering multiline for description
3. ability to save draft and submit later - i have this error and not able to submit and need to reenter everything when i refresh / logout.

Add a restriction in cmswww to enforce that a user can only submit 1 invoice per month.

https://github.com/decred/contractor-mgmt/blob/master/cmswww/database/cockroachdb/cockroachdb.go#L368-L379

Required files need to be checked for existence and that they are readable.
I would also recommend loading the keypair with tls.LoadX509KeyPair() to verify correctness.

gometalinter has recently moved gosimple and other tools into their staticcheck tool. staticcheck finds a lot of errors with the current codebase, so in the PR which adds staticcheck to goclean.sh, we'll need to go through and fix all the issues it finds.

I'd like to suggest (and I may be happy to look at submitting a PR request myself for) using UUID's for primary keys rather than int's. One of cockroachdb's main advantage is its ability to scale horizontally, but using keys like this prevent that from being fully utilised if it's ever needed.

By using UUID's, nodes can more easily share workload. While perhaps not needed for this project (I don't see it needing the kind of scale that cdb offers, but I may not understand well), changes to database design are easiest to do now before the project is in production, and helps future-proof the design.

From the doc notes (https://www.cockroachlabs.com/docs/stable/serial.html):

In most cases, we recommend using the UUID data type with the gen_random_uuid() function as the default value, which generates 128-bit values (larger than SERIAL's maximum of 64 bits) and more uniformly scatters them across all of a table's underlying key-value ranges. UUIDs ensure more effectively that multiple nodes share the insert load when a UUID column is used in an index or primary key.

For the system to support proposals like the bug bounty program we need to be able to submit a single invoice with multiple payout amounts and multiple extended pub key's.

example a csv format:
name,relevant github link of fix,extended pub key,pay out amount

This might also be useful when we have an event and temp hires need to be paid in DCR.

Creating an invoice change and creating or update an invoice payment requires both a change to the cmswww database and also a call to politeiad (UpdateVettedMetadata). This is being done in several places throughout the code and it needs to be consolidated into a function or group of functions.

Currently, when marking an invoice as paid, it will overwrite the mdStreamPayments with a single updated BackendInvoiceMDPayment. But it should support an array of those payments on that stream.

We need the ability for contractors to attach things like receipts to invoices for reimbursement. We can just support PNG and JPG initially.

When using a valid email/token pair and using the following info:

username: aa
password: password
name: Alex
Location: USA
pubkey: tpub....

I receive the error:
400 Bad Request, malformed username