fxbox/users

Project Link user management and authentication lib

users's Issues

Expose a AuthenticationMiddleware.verify method

So far AuthenticationMiddleware is simply creating a Iron middleware that verifies a token coming within the Authorization HTTP header. This works well for FoxBox's HTTP API, but we need something else for websockets.

Bump nightly version

The foxbox project has updated their nightly version to 2-22, we should keep in sync with that version too

See fxbox/foxbox#81

Improve readme.md

Fail to response with errno 102 and message in case of password shorter than 8 chars

Restrict setup call to same-origin

https://github.com/fxbox/users/blob/master/doc/API.md#post-setup will be called from the setup app on http://foxbox.local/, so we can serve more restrictive CORS for this specific API call.

Keep in sync rust version with foxbox

FoxBox is using a pinned version of rust nightly.

Review strings usage

Because of my lack of experience in Rust I found myself copying strings all over the place. I'm pretty sure we can use &str in many situations where String is currently used.

UsersDb::read should get a filter parameter

Right now UsersDb::read returns the whole database. For the basic login feature, we need at least a way to retrieve a record by its id.

Put test dependency out of regular build

Hide /setup endpoint or reject new requests if admin user already exists

Get rid of not implemented endpoints

Return session JWT on successful POST /setup request

Persist users in disk

Right now we are using an in memory sqlite db. We need to change this to a disk db when using the crate and keep in memory for testing

Authentication middleware

Refactor auth middleware

Right now the authentication middleware owns the list of authenticated endpoints. That means that we need to know in advance the endpoints that need authentication, which is not the case for FoxBox, where services are added/removed when they are detected.

Use bcrypt for storing passwords

MD5 is not sufficient. Let's use bcrypt instead.

Require one shot session token for user activation

#81 (comment)

Expose an API to set the database filename.

To fix fxbox/foxbox#146 we need to be able to set a database file name.

Run tests on Travis

We need to run the tests automatically on Travis.

Update rust nightly to 03-07

Following the changes in the foxbox project:

fxbox/foxbox#147

we should update the version too.

Add a limited ttl to tokens and implement refresh auth flow

Use iron/body-parser instead of manually parsing the body of the requests

POST /setup handler

Intermittent test failures

Various test fail intermittently.

Implement backoff protocol

We need a backoff protocol to request that clients enter a "backoff" state in which they avoid making further requests in periods of heavy load or in the case that a single client makes too many requests in a short period of time.

We can probably abstract this so it can be reused in foxbox and other servers.

Check responses body on tests

Right now we are only checking the response status. We must also check the body of the responses

Get rid of main.rs scratchpad and add some examples instead

Move UsersRouter tests to its own module

#6 (comment)

POST /login

Support secure browser resources

Eg. we may want to securely download videos/snapshots/other_media from foxbox using plain a[download] links.

Interview partners for research about communication in GitHub projects wanted

Hi. My name is Verena Ebert, and I am a PhD student at the University of Stuttgart in Germany.
A few months ago, I have examined 90 GitHub projects to see what communication channels they use and how they write about them in the written documents, for example README or wiki. If you are interested in the previous results, you can find them here:
https://arxiv.org/abs/2205.01440
Your project was one of these 90 projects and, therefore, I am interested in further details about your communication setup.

To gather more data about your communication setup, I kindly ask one of the maintainers to do an interview with me. The interview will be about 30-35 minutes long and via Skype, WebEx or any other provider you prefer. The interviews should be done in November 2022, if possible.

In this interview, I would like to ask some questions about the reasons behind the channels, to understand the thoughts of the maintainers in addition to the written information.

The long goal of my PhD is to understand how communication works in GitHub projects and how a good set of communication channels and information for other maintainers and developers looks like. One possible outcome is a COMMUNICATION.md with instructions and tips about which channels could be useful and how these channels should be introduced to other projects participants. Of course, if you are interested, I will keep you up to date about any further results in my research.

If you are interested in doing an interview, please respond here or contact me via email ([email protected]). We will then make an appointment for the interview at a time and date that suits you.

If you agree, I would like to record the interview and transcribe the spoken texts into anonymized written texts. In this case, I will send you the transcript for corrections afterwards. Only if you agree, the transcripts or parts of it would be part of a publication.

Add rust-clippy

Move code into foxbox

I read the readme and I can appreicate the intent to make something that can be resued and extended. But right now, the coupling is tight and specific to foxbox and the extra layer of indirection doesn't help us either.

Making a iron-user-module crate is a different goal than building Project Link and I don't think we should sign up for that. I've created a few user systems before 😉 and based on experience, this stuff is better as a boilerplate than of a library/crate.

With that said, I feel strongly that we should merge this repo with foxbox. There should only be 5-6 files to move over into a module directory. I can help doing this.

📟 @fabricedesre @ferjm @arcturus