peppydays / things Goto Github PK

To do

• Implement cache for cargo outputs

To do

• Load context values (e.g. database host, id, password, application port, .. etc) from environment variable
• Set values

To do

• Change String to &str wherever needed
• https://blog.logrocket.com/understanding-rust-string-str/#:~:text=The%20important%20difference%20is%2C%20that,otherwise%20it%20won't%20compile.

• Configure the Account service
• Ensure implementing health check API

To do

• Emit logs to standard output
• Set basic logging configuration

To do

• Use GitHub Actions to do CI
• CI includes building for release and running test

To do

• Check if access token is valid (controller's responsibility)
• Update the member's refresh token as null

https://github.com/PeppyDays/things/wiki/Account-Boundary-Context#sign-in

To do

• Create RefreshAccessToken command
• Generate the new access token and refresh token if the requested refresh token is valid
• Valid refresh token means that it is the same as the persisted refresh token of the user, and it is not expired
• If the requested token is not valid, return UNAUTHORIZED (and this will make the client to redirect to the login screen)

• Research password hashing algorithm and document it
• Save the hashed password and make it possible to match

To do

• Implement database migration with sqlx
• Make migration for each application start

Steps to reproduce

http post http://localhost:8080/account/user/sign-in-with-credential id=4eae0836-50bb-4ead-96e2-985d53441e01 password=welcome

http: error: ConnectionError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response')) while doing a POST request to URL: http://localhost:8080/account/user/sign-in-with-credential

thread 'tokio-runtime-worker' panicked at domain/src/user/models.rs:109:52:
called `Result::unwrap()` on an `Err` value: PhcStringField
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Issue

When requesting sign in with unregistered user ID, it creates an default User instance having empty string password. When creating PasswordHash instance and unwrapping it, panic happens.

What to expect

When requesting sign in with unregistered user ID, it should be the same response as the password of existing user is not verified.

To do

• Read https://www.lpalmieri.com/posts/error-handling-rust/
• Implement display and debug for splitting error messages for each purpose
• Implement source method to track error trace

To do

• Add the path to the router and handler
• Call refresh identity command and gracefully handle the result, especially for TokenRefreshFailed error

To do

• Add CI Workflow
• If needed, react from the result of linting

To do

• Add /sign-out controller and handler
• Need to get user information from access token header (Authorization)

Context

• Identity is about authentication and athorisation, and User is .. just a member information that holds roles (user = member + admin)
• Some virtual requirements
  • A user can sign in one of the roles: member or admin
  • Identity aggregate issues and validate JWT token that also maintain roles
  • Basic functionalities - sign up, sign in and sign out are required, and sign in is established by emails and password
  • When entering my page, the user's information should be shown as follows
    • name, birth year, email, preferred locale

Log

• Documented here

To do

• Add middleware to generate user information and send it to the handler
• Add middleware to verify access token and send user information to the handler