macielti/porteiro

A microservice for users and authentication management

Porteiro

"clift cloft Still, a porta se abriu!" - Porteiro

This service is responsible to managing and authenticate users.

License

Copyright © 2021 Bruno do Nascimento Maciel

This program and the accompanying materials are made available under the terms of the Eclipse Public License 2.0 which is available at http://www.eclipse.org/legal/epl-2.0.

This Source Code may also be made available under the following Secondary Licenses when the conditions for such availability set forth in the Eclipse Public License, v. 2.0 are satisfied: GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version, with the GNU Classpath Exception which is available at https://www.gnu.org/software/classpath/license.html.

Bibliography

• OWASP - Forgot Password Cheat Sheet
• Datomic - Schema Reference

porteiro's Issues

Rename service to "Poteiro"

"clift cloft Still, a porta se abriu!" - Porteiro

https://wikicasteloratimbum.fandom.com/pt-br/wiki/Porteiro

Adapt service to be deployable via docker image

Add a Docker Image publish Github action step.

Add an implementation of `porteiro.db.datomic.password-reset/valid-password-reset-by-token` Datomic function to Datalevin

Healthy check endpoint security

The healthy check endpoint should require authentication?

I am thinking about requiring a JWT token to get the healthy status of the service.

Make `POST /api/users` return the `user-id`, `username`, `email` and `roles`

Add `api` segiment to endpoint url

User EDN for config file

Add an implementation of `porteiro.db.datomic.contact/insert!` contact Datomic function to Datalevin

Make the available roles configurable via settings file

Add an implementation of `porteiro.db.datomic.password-reset/insert!` Datomic function to Datalevin

Trust in the JWToken to do roles verification can be a problem

What about if we want to drop some roles from a user instantly? The user will remain in possession of the roles while the current JWToken is valid and not expired.

If we want the roles update operation to affect users instantly we should think in a way of having a service responsible for validating JWToken sessions, so the user-identity interceptor of every service should verify the JWToken using this service before letting it go.

This can have its cons and pros. One pro is that we will be able to expire JWToken sessions actively instead of having to wait for the expiration time passively. One con is that we would have to make an HTTP call to the JWToken session verification for every time that we need to use the info stored in JWTokens.

I think that one HTTP call is a fair price to pay for the guarantee and access-control benefits that it will enable us to have.

Trust on the JWToken

Get the user info from the JWToken instead of making a query to the database to get the roles information.

Create `user` entity Datalevin schema definition

Based on:

porteiro/src/porteiro/wire/datomic/user.clj

Lines 4 to 26 in a0cfc75

	(def user
	[{:db/ident :user/id
	:db/valueType :db.type/uuid
	:db/cardinality :db.cardinality/one
	:db/unique :db.unique/identity
	:db/doc "User Id"}
	{:db/ident :user/username
	:db/valueType :db.type/string
	:db/unique :db.unique/identity
	:db/cardinality :db.cardinality/one
	:db/doc "User username"}
	{:db/ident :user/roles
	:db/valueType :db.type/keyword
	:db/cardinality :db.cardinality/many
	:db/doc "User roles"}
	{:db/ident :user/email
	:db/valueType :db.type/string
	:db/cardinality :db.cardinality/one
	:db/doc "E-mail address"}
	{:db/ident :user/hashed-password
	:db/valueType :db.type/string
	:db/cardinality :db.cardinality/one
	:db/doc "Hashed password"}])

Add an implementation of `porteiro.db.datomic.user/add-role!` user Datomic function to Datalevin

Test if we have the problem with multiple users with the same email

Add username to token encoded info.

From the JWToken I want to be able to know what is the usernames of the user that the token represents.

User entity should have a role property to control privileges

The role information should be inside the JWToken login result.

Be able to authenticate using either email or username data

While authenticating the customer should be able to authenticate himself using the email or username.

Add a way of creating the service with a admin user setted by settings

Since we don't have an endpoint to create an admin user if we are not an admin first, we need to have a way of setting a default admin user in the settings file.

Add authenticated token when creating a new user account (HTTP Response)

When a user creates an account, the service should already do an authentication process returning a valid auth token.

Add an implementation of `porteiro.db.datomic.user/by-username` user Datomic function to Datalevin

Add an implementation of `porteiro.db.datomic.user/insert!` user `Datomic` function to `Datalevin`

We need to reimplement the porteiro.db.datomic.user/insert! for Datalevin database.
This task also contemplates the lookup function.

Add endoint to be able to add roles to user entity

Add an implementation of `porteiro.db.datomic.user/by-email` user Datomic function to Datalevin

Ask customer to setup a Telegram contact

When a user account is created we need to send an email with information about how to set up a Telegram contact.

Use latest version of net.clojars.macielti/common-clj

Add Contact Entity

A Contact entity will be a general entity to deal with different methods of contacting a user.

• Email
• Telegram

Add an implementation of `porteiro.db.datomic.user/insert-user-with-contact!` user Datomic function to Datalevin

We need to reimplement the porteiro.db.datomic.user/insert-user-with-contact! for Datalevin database.