lcpojr/watcher_ex

An Oauth2 server interelly in elixir.

watcher_ex's Issues

Adds brute force detection \ protection

We have to block an subject that fails on sign in continuously temporarilly.
This will help a lot to prevent this kind of attack because any attempt after subject be blocked will not succeed.

Add application admin routes

We have to start creating admin APIs to be facilitate our tests while developing.

Create Two Factor authentication

We could start by just requests totp.

Create better configurations for cache

We could use redix and other services for saving cache instead of local ets.

https://github.com/cabol/nebulex_redis_adapter

Improve configurations and secret storage

Policies validation

I was reading the policies on authorizer app and something came into my mind when I read the validation part. Shouldn't we catch all on validation failure? I mean, when the first function clause doesn't match.

  def validate(%Conn{private: %{session: session}} = context) when is_map(session) do
    case session do
      %{subject_id: id, subject_type: type} when is_binary(id) and type in @subject_types ->
        Logger.debug("Policity #{__MODULE__} validated with success")
        {:ok, context}

      _any ->
        Logger.error("Policy #{__MODULE__} failed on validation because session is invalid")
        {:error, :unauthorized}
    end
  end

  def validate(%Conn{private: %{session: _}}) do
    Logger.error("Policy #{__MODULE__} failed on validation because session was not found")
    {:error, :unauthorized}
  end

The difference is that it returns a 50x instead of 403 because the process dies (right?)

Create autorization plug

When we starting creating admin routes we will need an authorizer plug to ensure that the subject really is an admin.

Move validations to RestAPI applications

It will be easy to test and makes more sense if we move all input validations to RestAPI controllers.

Better endpoint documentations

In order to improve the endpoint documentation \ tests it would be nice to have an library to generate docs for endpoints.
Maybe we could use this: https://github.com/open-api-spex

Add user admin routes

We have to start creating admin APIs to be facilitate our tests while developing.