on3iro / trigen-backend Goto Github PK

Only store salted password hashes.

Saves changes to one of a users accounts
JWT is required!

Request body:

{
    "domain": "lfksafd.net",
    "username": ";laskjdf",
}

...just...DO IT!

Deletes one of a users accounts
JWT is required!

Only accept api requests from the frontend domain. (Settings in Nginx)

Change password and/or email
The old password/hash needs to be validated with the value in the database inside the backend.
Needs authentication via JWT, maybe even a reauthentication. So that it only works with a freshly generated Token!

Request-Body:

{
  "email": "[email protected]",
  "oldPW": "oldPW",
  "newPW": "newPW",
}

Gets a single users id and email
Needs authentication via JSON Web Token

Response:

{
  "id": "ABC123",
  "email": "[email protected]"
}

Logs in a specific user by returning a json web token which could then be used for further requests.

Request-Body:

{
  "email": "[email protected],
  "password": "password"
}

Das "JWT" sollte wirklich vor dem Token stehen!
Response:

{
   "token": "JWT saldkfjo8j92832-238r-asdjf-as0djf0329...',
   "user": {
        "id": "1",
        "email": "[email protected]",
        "maxAccounts": 5,
    }
}

Activates a newly registered user account.
Request should be sent from an email.

Response: 200 ok

Gets a list of saved accounts for a specific user.
JWT is required!

Response:

[
  {
    "id": "alsdjf",
    "domain": "domainName.TLD",
    "username": "username"
  },
  {
    "id": "sadfadsf",
    "domain": "domainName2.TLD",
    "username": "username2"
  }
]

Adds a certain number of slots to the users maximum. (Usually when the user buys 'em)
The packageName part represents one of the available slot packages, e.g. small for 10 accounts, medium for 50 and large for 100...)

JWT required!

Make user_id, domain, username unique in database.

Logs out the currently logged in user

Request-Body:

{
  "userID": "id",
}

Response: 200 ok

Deletes a single user and his accounts

Add appropriate error checking and handling. Return nice error messages.

User and Account should be removed from triserv.py and put into separate files under resources/.

Registers a new user

Request-Body:

{
  "email": "[email protected]",
  "password": "password"
}

Response-Body:

{
  "id": "userID",
  "email": "[email protected]",
}

Gets the user specific hash
Needs authentication via JWT! Should probably use a fresh token - if has been in use for a longer period of time, reauthentication is necessary. (we probably won't implement refresh tokens for now, though...

Response:

{
  "hash": "hash"
}

Adds a new account to the users account list
JWT is required!_

Request:

{
    "domain: "domainadfasdlk.de",
    "username": "aldskjf",
}