ratsch0k / group-car-api Goto Github PK

The current implementation of the invite user endpoint requires the user to know the id of the user he/she wishes to invite. This is not something the user should know. Add the property username to the request body to allow invite via username.

Reason

With the new members endpoint, it's not necessary to include members in the get groups endpoints. This way the group service and repository can be simplified.

A new endpoint should be added with which a pseudo-random generated profile picture should be returned. Which can be shown to the user when he/she wants to create a new account. The seed for the pseudo-random generation is the given username.

Every user account gets a pseudo-random generated profile picture which will be stored and can be accessed.

Feature

User can log in with new endpoint if he previously signed up.

Acceptance

A new endpoint is created with which the user can log in. A user can only log in if he has an account

• New endpoint for log in
• Handle login of user

Api endpoint for the frontend to login only via the jwt token. Check if not pre-login token and if username still exists. If all checks correct respond with ok and if not with unathorized.

Enpoint Specification

Method: POST
Required Request Body:

{
  "oldPassword": "<string>",
  "newPassword": "<string>",
}

Implementation details

1. Check if old and new password are different.
2. Check if new password fulfills password constraints.
3. Check if old password is correct.
4. If all checks passed, change password. ✔️

A user can create a new group and is then the owner and an admin of that group.

Without specifying the argument --disableFlush the database will be flushed on each start. This is unnecessary and should be removed. Instead, add the argument --flush-db which will force flush the database.

If the session expires, the server replaces the jwt cookie with a PreLogin session and should send a NotLoggedInError response to show the client that the user is not logged in anymore. But instead, it sends an UnauthorizedError. This leads to unexpected behavior in the client and will show a confusing error message.

The sign-up endpoint has to be updated with new validation constraints.
The following constraints have to be added:

• Username cannot contain whitespaces
• Username has to consist of certain characters
• Username has to be at least 4 characters long
• Username has to be shorter than 25 characters
• Password has to be shorter than 255 characters (database restriction)

A new endpoint is added with which a user can logout

Add following stages to pipeline:

• Development Deploy:
  • Executed on every push or pull request on the develop branch
  • Deploys current state to the development server
• Beta Deploy:
  • Executed on every push or pull request to the master branch
  • Deploys current state to beta server
• Release Deploy:
  • Same step as deploy is now
  • This deploy stage is the only one with version checking

Progress:

• Dev Deploy
• Beta Deploy
• Release Deploy

The endpoint which serves to reinitiate a session always throws 401 Error

Feature

The user can sign up by via a new request.

Acceptance

A new user is created, the password is hashed and salted.

• New endpoint for signup
• Store new user in database

Add performance, error and misc monitoring

Feature

If the user logs in or signs up he receives a JWT Token with which the api can be used.

Acceptance

If the user logs in, a JWT is returned which will be set as cookie (Double Submit Method). The JWT defines the role of the user, the allowed routes and has an expiration time.

The data sent over the websockets if the car of a group is added, parked or driven is missing user data