mattsains / bank-api Goto Github PK

branch this to frontend-web

Not sure about specifics. Have permission ID which is referenced by users table. Edit as more ideas arrive

If additional information is required, send as a JSON response in addition to the error code.

for example, with any credentials, I can view information about every account in the database. This is bad.

Rename /accounts/pull to /accounts/index

Make an error handler to return consistent errors, (perhaps in JSON) and to do logging if it is required. This can coexist with a config getter (ie., time zone, bank name, currency symbol server)

Too grand a project:

It'd be cool if there was some fancy statistics thing that would notice dodgy errors (potential attacks_

Exactly what is returned in a list of transactions needs work. For example:

• Is it ok that the user can see the other participant's account id?
• Does it return enough information so that clients can tell whether it is a debit or a credit, for any type of account (ie., loan/saving)
• What about money coming in from other banks? That's a whole lot of zero from accounts.
• The same about money leaving the bank.

Will I just add interest at some point based on what is in the account? Or pro-rata? Either way, figure this out, and then implement it.

When you deposit money at an ATM, the money is immediately reflected, but it is "unavailable". Add functionality to keep track of that money which is not cleared. Add a permission that allows a member of staff to clear money. (given to bean counters)

• Change password
• lock account
• add some profile info:
  • email address
  • permission set (CSV - permission ID from permissions table [Issue #3])
  • etc

///comment

API does not take advantage of all API features.

Add a config entry called "allow-http". If this is false, always direct requests to the HTTPS url.

These functions need to be more aware of their errors, and return a status code: (true, false)

• user::set_lockstate
• user::change_psw
• more!

Write this API function to see what the balance was at some optionally given timestamp, for a given account. This will be used by accounts->index to show current balances.
If no timestamp given, function returns current balance.

So that accounts have types, such as "Student current" or "Fixed deposit" and later on we can add conditions to this in Milestone 0.4-alpha.
Just named for now.

to do transfers, get specific information about transactions on an account, etc

Hash the hash with a salt.
Basically, hash hash hash salt salt salted hash hash salt hash.

Like https, dat stuff

Problem

Any user can discover aids that exist, because non-existent account return 404, while accounts not belonging to that user return 403. By querying all integer account ids, a user can figure out all the account ids in the database.

Potential Fix

Just return a 403 (access denied) error for all accounts which either do not exist, or are not owned by the user.