opencodeiiita / geek-editor-backend Goto Github PK

View Code? Open in Web Editor NEW

6.0 5.0 50.0 6.85 MB

JavaScript 93.43% Python 6.57%

opencode21 nodejs express

geek-editor-backend's Introduction

Geek Editor Backend

This repo is the backend of the geek editor project. It provides various APIs to the client.

Tech Stack

Getting Started

Set up in Your local system

You must have git, nodejs and mongoDB installed in your local system.
Run MongoDB on PORT 27017.
Make sure python is installed in your computer.
```
mongod
```
Fork this repo and then clone the forked repo.
```
git clone 'YOUR REPO LINK'
```
install dependencies and run the server
```
npm install
pip install -r requirements.txt
node app.js
```
This will make the server run at http://localhost:8000/

Database Schema

User Schema

Field	Data Type	Required
fname	String	true
lname	String	true
username	String	true
email	String	true
hash	String	true
salt	String	true
codes	[ ObjectId ]	false
year	Date	false
followers	[ObjectId ]	false
following	[ObjectId ]	false

Code Schema

Field	Data Type	Required
userID	ObjectId	true
code	string	true
language	string	true
languageCode	string	true

APIs

Routes	parameters	body	Description
`GET` user/profile/	username		Retrieves the data of the logged in user
`POST` user/register/		email, username, password, fname, lname	Registers a user by taking name, email, username and password as input
`POST` user/login/		email, password	Take the email and password as input and returns the token if the credentials are valid
`POST` user/update/	id		Verify and update the data of the user
`DELETE` user/profile/	id		Verify and delete the data of the user
`GET` user/profile/	id		Get user by given id
`PUT` user/follow/	id		Follow the user with the given id
`POST` user/forgotpassword/		username	For changing the user password
`GET` user/verifyEmail/	username, hashid		For verifying the email of user by taking username and hashid as input
`GET` user/reset/	hashid		Get the password reset page where we enter the password
`POST` user/reset/	hashid	password	For changing the user password by taking hashid as input
`POST` user/sendmail/		link,username,message	Sending mail by controller
`POST` user/codes	id		Take the user Id and returns all the codes associated with the user
`GET` user/languages	id		Take the user Id and returns all the languages associated with the user
`GET` codeapi/	codeId		Getting the code by taking codeId as input
`POST` codeapi/submitCode		userId, code, language, languageCode	Adding a code by taking userId as input

Get Method

Home Page ("/")
Get Profile ("/getprofile") Fetches the profile of a user.

Post Method

Access Tokens

For each login, a user session is created using an access token. The access token is a JWT (JSON Web Token) with a expiration time of 2 hours. For each request to a protected route, the client-side sends an access token to verify the user identity.

Verify access token ("/verify-auth-token") : verify the existing access token, by sending it in the authorization header as

headers: {
   "Authorization":"Bearer <YOUR_ACCESS_TOKEN>",
}

Refresh Tokens

The access tokens send to the client has an expiration of 2 hours. That means any request made by the client 2 hours after the login, will fail and user will need to re-verify his/her identity by loging in again. To prevent this we use a refresh token which is used when the access token expires.

Refresh Token ("/refresh-token") : Refresh the session of user by verifying the refresh token send by client and generating new sets of access and refresh tokens, and thus preventing user to loging again

Note: The refresh token is also bounded by an expiration time of 10 days. This is comparatively very large with respect to the expiration time of the access token. If both the access and refresh tokens are expired, the user must login again.

Generation of Salt and Hash

A salt is generated using crypto library already present in nodejs. A Hash is generated using pbkdf2 function and passing password, salt, 10000(iterations), 64(no. of Characters) and "sha521"(a hashing function) as parameters. This salt and hash is stored in user database as passwords

More About sha512 More about pbkdf2

Verify Password

Salt, hash, and password are passed as parameters in verifypassword(). A hash is generated using password and salt and is matched with the hash already present in the database. If they are same, user is authenticated.

Authentication

When a user is logged in or registered a 256 byte token is sent to access any methods in the api the token has to be sent in the x-access-headers while sending the request

Claim an Issue

Comment on the issue. In case of no activity on the issue even after 2 days, the issue will be reassigned. If you have difficulty approaching the issue, feel free to ask on our slack channel.

Communication

If you have any queries or suggestions, please use the discord channel of Geek Editor FrontEnd.

Guidelines

Please help us follow the best practice to make it easy for the reviewer as well as the contributor. We want to focus on the code quality more than on managing pull request ethics.

People before code: If any of the following rules are violated, the pull-requests must not be rejected. This is to create an easy and joyful onboarding process for new programmers and first-time contributors.
Single commit per pull request and name the commit as something meaningful, example: Adding <-your-name-> in students/mentors section.
Reference the issue numbers in the commit message if it resolves an open issue. Follow the pattern Fixes #
Make a note to add relevent Screen Shots when you make a PR.
Pull Request older than 3 days with no response from the contributor shall be marked closed.
Do not make PR which is not related to any issues.
You can create an issue but you can only solve that particular issue if we approve it.
Avoid duplicate PRs, if need be comment on the older PR with the PR number of the follow-up (new PR) and close the obsolete PR yourself.
Be polite: Be polite to other community members.
PR template should be strictly followed, else the points won’t be reflected on the leaderboard.

happy coding.

geek-editor-backend's People

Contributors

Stargazers

Watchers

geek-editor-backend's Issues

Setup and add getCode in codecontroller

Description

Set up codeController file and add getCode method (GET Method) at /:id which would take codeId as param. All routes of code should begin with /code. So the route should be get code should be a get method at /code/:id.

Multiple users with same username

There can be duplicate users with same username this might cause some problems .
I want to work on it.

Authorization header

Currently access token is sent to server in x-access-token. Change it so that the token is sent in the authorization token with Bearer authorization scheme.

Languages by user

Create an API to get all the languages used by a user and add that route in Readme as well.

Add language, language code and timestamps in code schema

Data type Language and language code is string.

Improving Authentication

The Authentication of the current project is not checking whether the user is accessing or someone else this can be improved.
I want to work on it.

Update readme

Description

The repo has recently changed its authentication to JWT from passport. Update the readme with JWT authentication and remove the explanation of passport auth.

BRUTEFORCING AND DDOS

Currently there is no protection from ddos or bruteforcing the password as shown in the below screen shot just 19 lines of code was sufficient to break down into the server in seconds and find out the password and all the details of the user. This vulnerability not only gives out the users personal details but also it might slows down or crash the server due to huge no. of request this has to be taken care.
@aknsal
More about DDOS - https://en.wikipedia.org/wiki/Denial-of-service_attack

Code cleaning

Description

Clean the code in api.js, app.js, authController.js and codeController.js. You can remove unwanted comments and add some comments to explain the code. You can also refactor the code.

Recaptcha verification

To avoid attacks on the server by passing multiple requests captcha verification is required. I would like to implement it @aknsal

Update Code Schema in Readme.md

I would like to work on this

User logout route

Making a route for logging out user.

Make a home route

Make a home route that just shows the text "Server is Working" in the browser,

Update the field userID in code schema.

Add required to true in userId.

make a verify token route and use cors

As of now there is no route to verify an existing token. The task is to make a route to verify tokens sent by user

NOTE : use cors middleware to make the API's accessible to frontend. Also update the readme.md

Password reset

A feature to update the password using email verification .

Change user routes

Update the user routes so that every route related to user should start with /user. Make a different file for all the user routes.
For eg. the route to update user data the route is /update/:id, this can be changed to /user/update/:id.

Set up this project in your local machine.

Set up the project in your local machine and send the screenshot of terminal. You should have mongoDB installed and running in your system.
This issue is open for all, no need to claim.

API to add new code

Description

Create a new API to add code to code schema and simultaneously add that codeId to code array in userSchema

Major bug in delete user, update user

The current functioning of delete user and update user takes id as the parameter in the url this can be an issue when some one tries to delete user by using that id(which can be easily accessed) hence it needs to be secured.

Enhancement in authentication middleware

Currently we are checking whether the jwt token is exact same as in our database in the respective routes instead of verify User middleware and also when we login the new jwt token doesn't replace the old one in our database.
I'll like to correct these.

remove unused files and update readme.md

Since now the userRoutes.js contains all the user related APIs, the api/api.js file is of no use now. Also readme.md needs to be updated.

Add an API to get user info

Add a controller to get user info by passing userId as a parameter. Add a route for this. It should be a get method at /profile/:id.

Changing userId and codes array item in Schema

Currently, in the schema, the userId field in the code schema's type is a string. Assuming that this field will be used to store the _id of the MongoDB document of a user it type should be changed to the mongoose.Schema.Types.ObjectId, along with a ref to user schema so as to add a foreign key. Similar thing needs to be done with codes array in user schema whose individual item's type should be a mongoose.Schema.Types.ObjectId and a ref to codes schema. I would like to work on this issue.

Proper email verification

Currently the email verificator checks only wheather the email ends with @gmail.com or not this can be improved.

Update readme.md

Update readme.md to contain info about /refresh-token route

Add docker

Build docker to improve the development environment.

Get code by User

Create an API to get all the codes by the user and make required changes in the README

Add Followers

Description

You have to implement a new feature in which users can follow other users.
You can add new fields of Array (Followers and Followings) in user schema and create a new route /follow/:id in api.js which will take the id of a user as a parameter to follow.
Add required methods in the authController to add followers and followings to the array.

Sign in with google

I would like to implement a feature sign in with google so that it makes authentication easy for users.
@aknsal

Add an Api to update profile

fix code route

Currently the route to get a code using Id is not working correctly, it sends all the codes not only the requested one

I want to fix this

Add expiration to tokens and update readme.md accordingly

Currently there is no expiration for the accesstokes. add a expiration for the tokens and update the following info in readme.md

Swagger ui implementation

Example website of swagger ui - https://todo-app-csoc.herokuapp.com/
Swagger ui helps in easy identification of the end points in the api and with a try it out increases the ease of access and productivity
more details can be found here https://swagger.io/tools/swagger-ui/

Update readme with API

Description

Add a new section of API and give a brief about all the API endpoints in the readme.

You can create a table mentioning the route, any parameters required, and a brief about what that API does.

Email is not validated.

The email address of a user does not get validated to check whether it's in right format or not. Like i can fill my email as "abc" and it will get accepted. I would like to work on this issue so that only the emails which have a valid format is accepted. For example "abc" won't be accepted but "[email protected]" will be accepted as it has the correct format for an email.

Description

Add API to update and delete existing Code.

opencodeiiita / geek-editor-backend Goto Github PK

geek-editor-backend's Introduction

Geek Editor Backend

Tech Stack

Getting Started

Set up in Your local system

Database Schema

User Schema

Code Schema

APIs

Get Method

Post Method

Access Tokens

Refresh Tokens

Generation of Salt and Hash

Verify Password

Authentication

Claim an Issue

Communication

Guidelines

geek-editor-backend's People

Contributors

Stargazers

Watchers

Forkers

geek-editor-backend's Issues

Description

Description

Description

Description

Description

Description

Description

Recommend Projects

Recommend Topics

Recommend Org