housewarehq / backend-engineering-octernship

Houseware

Company information

Houseware's vision is to empower the next generation of knowledge workers by putting the data warehouse in their hands, in the language they speak. Houseware is purpose-built for the Data Cloud’s untouched creators, empowering internal apps across organizations.

Why participate in an Octernship with Houseware

Houseware is changing the way the data warehouse is leveraged, and we want you to help build Houseware! Our team came together to answer the singular question, "how can we flip the value of the data warehouse to the ones who really need it, to the ones who drive decisions".

In this role, you'll have the opportunity to work as a Backend engineer with the Houseware team on multiple customer-facing projects, the role being intensive in technical architecture and backend engineering. The ability to have a constant pulse on the engineering team’s shipping velocity, while accounting for stability and technical debt looking forward is crucial.

Octernship role description

We're looking for backend developers to join the Houseware team.

We are hell-bent on building a forward-looking product, something that constantly pushes us to think by first principles and question assumptions, building a team that is agile in adapting and ever curious. While fast-paced execution is one of the prerequisites in this role, equally important is the ability to pause and take stock of where product/engineering is heading from a long-term perspective. Your initiative is another thing that we would expect to shine through here, as you continuously navigate through ambiguous waters while working with vigor on open-ended questions - all to solve problems for and empathize with the end users.

You are expected to own the backend and infrastructure stack end-to-end, understand the business use cases, map it to the best-in-class engineering systems while maintaining a great developer experience. This role involves a high level of attention to detail, debugging and testing skills, as well as long-term thinking with respect to the scalability of our platform.

Octernship info	Timelines and Stipend
Assignment Deadline	26 March 2023
Octernship Duration	3-6 Months
Monthly Stipend	$600 USD

Recommended qualifications

You’d be a great fit if:

• You’re proficient in Golang and Python, having prior experience building backend systems and hands-on experience with AWS/GCP.
• You’re familiar with the modern data stack and have a good understanding of Infrastructure-as-code tooling like Terraform.
• Plus Points if you’re a contributor to open-source, we’d love to see your work!

Eligibility

To participate, you must be:

• A verified student on Global Campus

• 18 years or older

• Active contributor on GitHub (monthly)

Assignment

Implement an Authorization+Authentication service in Golang

Task instructions

The assignment is to create a backend API service in Golang that handles authorization and authentication for a web app. The details of the web app are as follows:

• A simple web app where users in an organization can signin and list all other users in their organization
• Logging in is performed by supplying a username, password combination
• Note that all passwords should be hashed when stored in a database for security purposes
• For simplicity, assume that the existing users have already been registered and we are not concerned about a user registration flow here.
• The user should be logged in with a JWT token, with a one hour expiry.
• The user should be able to receive a new access token using a 'Refresh token' with a validity of 24 hours.
• The user should be able to logout as well.
• There are admin privileges assigned to a few users, which gives them the ability to add new user accounts or delete existing user accounts from their organization.
• All non-admin users should be able to see other user accounts but shouldn't be able to add/delete any user accounts.
• Note that any user shouldn't be able to view/add/delete user accounts into any other organization.

The API should follow REST API conventions, feel free to design the API structure as you may. The API should cover the following functionalities:

• User Login
• User Logout
• Admin User adds a new User account(by providing the username & password)
• Admin User deletes an existing User account from their organization
• List all Users in their organization

Note: Do add unit tests(for success & failure) for each API endpoint.

Provided in this Github template is a Golang Standard repository, you'd have to design an ideal architecture/stack for this problem

• Golang framework for this API
• Which Database shall be used to store the user details?
• The ORM that shall be used for interfacing with the Database
• DB design

Do document the design decisions and the rationale behind the same in a README file.

1. Please push your final code changes to your main branch
2. Please add your instructions/assumptions/any other remarks in the beginning of the Readme file and the reviewers will take a look
3. The PR created called Feedback will be used for sharing any feedback/asking questions by the reviewers, please make sure you do not close the Feedback PR.
4. The assignment will be automatically submitted on the "Assignment Deadline" date -- you don't need to do anything apart from what is mentioned above.
5. Using GitHub Issues to ask any relevant questions regarding the project

Task Expectations

• Instructions in the Readme to setup the API & the relevant database
• Postman/Swagger/OpenAPI spec so that the APIs can be tested
• The task will be evaluated on the: fulfillment of the requirements and correctness of the API responses, in addition to the simplicity & architecture of the solution

Task submission

Students are expected to use the GitHub Flow when working on their project.

1. Making changes on the auto generated feedback branch to complete the task
2. Using the auto generated Feedback Pull Request for review and submission
3. Using GitHub Discussions to ask any relevant questions regarding the project

backend-engineering-octernship's Issues

Feedback PR got closed after a force push

Hi @shubh24 @sp35 @nipunj15 @theBstar
My feedback PR created by the github classroom got closed mistakenly after a force push.
Please can i get it reopened as i am unable to

I look forward to your response.

Cannot import modules.

I'm trying to import modules but I keep getting same error message: "no required module provides package XYZ"
I'm so tired spending hours on trying to figure this out. I ran "go mod init" but no luck.

How to submit assignment properly ?

In assignment-update's branch readme file ,it is written that submission should on github classroom,but i am unable to find any classroom related to houseware.
While in feedback branch's readme file it is written that we have to make changes on feedback branch and not merge auto-generated PR on feedback from main.
I have done changes on feedback branch but meanwhile by mistake i have merged the auto-generated PR on feedback from main. What should i do ?
And do i have to commit final changes on main or feedback branch?

Regarding Golang framework ,database or ORM use

Is there any restriction using any Golang Framework and database , orm ?
Shall we use according to our proficiency and past experience?

Can i submit my assignment now?

When can I expect to get any update for my submission?

Unable to store cookies: http.Cookies are getting stored in postman but not in browser

On User 's successful login request ,I am saving tokens as http.cookies from the backend.
When i make login request using postman the cookies are stored in postman's cookies but on the other hand if i make login request through my React.js client from browser they are not stored in browser's cookies section. i.e.(/devtools/application/cookies)

Code:

Storing cookie-

ctx.SetCookie("accesstoken", token, int(AppConstant.TOKEN_COOKIE_EXPIRY), "/", "localhost", false, true)
ctx.SetCookie("refreshtoken", refreshedToken, int(AppConstant.REFRESH_TOKEN_COOKIE_EXPIRY), "/", "localhost", false, true)

Login request from react.js client-

export async function AuthenticateUser  (username,password) {
        const res=await fetch(API_URL+API_LOGIN_ENDPOINT,{
        method:"POST",
        headers:{
            'Accept': 'application/json',   
            "Content-Type":"application/json"
        },
        
        mode:"cors",
        body:JSON.stringify({
            "username":username,
            "password":password,
        }),

    });
    return res.status===200

}

Frameworks used: Gin-Gonic(Backend) ,React.js(Frontend)
Tested on Browsers:Firefox ,brave.

Although i have read and tried some threads on internet that latest browser ignores domain="localhost" and also domain containing less than 2 periods i.e. "api.app.localhost" is valid but "localhost" is not.
One thing i could do is, get tokens from backend and then save them in cookies at client side and then further use them
but that's not good practice as per many people.
Then how can i achieve my goal of storing cookies in browser when domain is localhost ,In order to setup test environment for this assignment ?

Submitting Changes

Am I supposed to fork the project and work on the main branch of the fork and push the changes to the main branch and wait for it to be reviewed?

I'm a little bit confused.

What is the best practice to revoke token?

Assume a case in our assignment,that a ADMIN removes itself from database.
Now the logic i have wrote,allows this removed ADMIN to access authorised endpoints until access-token expires(happens after 1hr)
and then after 1 hr during refresh token rotation it throws 401:Unauthorised as user doesnt not exist anymore.

I want to know what is the best practice to revoke a token and shutdown user's authorised access?
Is it okay to just stick with the logic i have or there can be something more effective for this assignment purpose.

EDIT:Implemented logic which checks whether user exists in DB or not while validating access-token in authorization middleware.Basically using token's claims ,user's document ID will be provided from token to .findByID() method to query in database if this fails then user no longer exists hence user is now unauthorised

What logic to add for unit testing API endpoints ?

'Note: Do add unit tests(for success & failure) for each API endpoint.' as mentioned in README.md file.
I am trying to add unit tests but i am not understanding what logic should i add for testing endpoints.
For eg
/login -> how can i unit test this endpoint?

Please someone help.

I have completed the assignment in the private repo made for me, Is that right?

I have completed the assignment, before the deadline, in the private repository that was made for me. Do I have to do anything else except that?