reftoken / api-boilerplate Goto Github PK

Add better error handling and error response from API

┆Issue is synchronized with this Asana task

It should be possible to upload files to the API. These files should then be accessible from the API

┆Issue is synchronized with this Asana task

Add API docs to easily generate documentation for endpoints and so on.

┆Issue is synchronized with this Asana task

Add magic link style login for the API

┆Issue is synchronized with this Asana task

Update readme with correct info

┆Issue is synchronized with this Asana task

I've made a not so great docker file already, but I'll hand it over to you to fix it ;)

┆Issue is synchronized with this Asana task

Create a user response model which can be attached to the context and be returned as a response from the API. The purpose is to ensure consistency throughout the application.

┆Issue is synchronized with this Asana task

Add JWT check on all protected routes

┆Issue is synchronized with this Asana task

Would be good with a logger to .json files for production and a memoryleak detection pakage.

Suggestions:
Bunyan
memwatch

┆Issue is synchronized with this Asana task

To increase the security of the token it should be made invalid if it is older than 5 minutes. Also, once the token is used it should be deleted from the database.

┆Issue is synchronized with this Asana task

API should be able to send emails

┆Issue is synchronized with this Asana task

NPM audit flags for a security vulnerability in the hoek package. Find out a way to close that.

┆Issue is synchronized with this Asana task

Blockstack recently released an update to their platform. Investigate if it is ready for use in production.

┆Issue is synchronized with this Asana task

Use access and refresh tokens to restrict access to the API.

┆Issue is synchronized with this Asana task

Add tests for the API

┆Issue is synchronized with this Asana task

Email SSO token needs to be deleted after use to avoid "tailgating" where an attacker can gain access of the token after it has been used, but within the 5-minute lifespan of the token, and use it to log in to the service as a shadow of the real user.

┆Issue is synchronized with this Asana task

Add websocket for realtime data.

┆Issue is synchronized with this Asana task

Currently got socket.io working, but we should use websockets instead. There is much less overhead and browser support is good enough. Only Opera Mini and IE8 and lower lack support.

┆Issue is synchronized with this Asana task