pckv/repost-fastapi

FastAPI backend for Repost

repost-fastapi's Issues

Implement endpoints to get resubs, posts and comments by user

Create resub endpoint (basic)

/resubs

Public schema:

• name
• description
• owner
• list of posts

Features:

• create a resub
• owner can delete the resub
• owner can transfer ownership
• owner can modify description
• owner can delete the resub

Create users endpoint (basic)

/users

Public schema:

• username
• bio/description
• avatar* (as external url)
• list over owned resubs
• list over posts by the user
• list over comments by the user

Features:

• get user by username
• create user (register account)
• update authorized user's username/avatar/bio
• delete authorized user

Create dependency for get user by username path operation `/users/{username}`

Get user dependency should handle error when it doesn't exist

Check that user exists in database when validating JSON web token

Depends on #19

Avoid using external dependencies

Currently, we are using starlette's status fields. This means that starlette is a dependency and should be in requirements.txt (if FastAPI stops using starlette at some point, it would be incompatible). FastAPI has its own status, so we should be using that.

Same for any others that we may be using. PyCharm will show where these are.

(this is not actually required for our project, but it would be a good consideration for a project with a longer lifespan)

Discuss if we should use user ID instead of user object when returning author/owner

Create comments endpoint (basic)

/resubs/{resub}/posts/{post}/comments

Public schema:

• id
• parent post (relation)
• content
• author
• timestamp created
• timestamp edited
• votes

Features:

• get comments in a post
• create a comment in a post
• author can delete their comment
• resub owner can delete any comment
• author can edit the content
• vote on comment {id}/vote
• reply to another comment /{id}/reply

Implement all users endpoints using CRUD

• Create User
• Get Current User
• Delete Current User
• Edit Current User
• Get User

Implement all resubs endpoints using CRUD

• Get Resubs
• Create Resub
• Get Resub
• Delete Resub
• Edit Resub

Create authorization endpoint (basic)

Features:

• get JWT
• get current user (in users endpoint /users/me)

Implement PATCH endpoint for editing current user

Requires a schema, defined the same way as EditResub and EditPost.

Add support for paging in lists

Endpoints should have parameters limit and offset

Comment need to know both the parent post and the resub so we can navigate to the post where the comment was made

Implement BCrypt hasing functions

These should not be part of the api module. Needs a new file, like repost.security or similar

Update docstrings to match a public documentation in schemas

Check that entities don't exist when creating new ones (e.g user with the given username doesn't exist -> 400 Bad Request)

Implement all comments endpoints using CRUD

• Get Comments
• Create Comment
• Delete Comment
• Edit Comment
• Create Reply

Database model and CRUD for resubs table

Model should for the most part reflect the API schema. Models should be in repost.models.resubs, and CRUD functions should be in repost.crud.resubs.

Further discussion must be made to decide columns: discussion in Discord.

Update authentication response status messages to fit Spring Boot implementation

In Spring OAuth2 Boot, invalid credentials is a 400 Bad Request, whereas it's a 401 Unauthorized in our FastAPI implementaion. 400 makes more sense for this.

In Spring OAuth2 Boot, invalid tokens are always a 401 Unauthorized, even for unparsable tokens. This kinda makes sense, so we can implement that here too.

Implement all posts endpoints using CRUD

• Get Posts
• Create Post
• Get Post
• Delete Post
• Edit Post

Database model and CRUD for users table

Model should for the most part reflect the API schema. Models should be in repost.models.users, and CRUD functions should be in repost.crud.users.

Further discussion must be made to decide columns: discussion in Discord.

Document all possible errors for authorized endpoints. These can have both 400 BAD REQUEST (failed to parse JWT) or 403 FORBIDDEN (unauthorized; this should be changed to 401 as per #38)

Invalid token due to deleted user should respond with 401 Unauthorized

If a user is deleted, the token should be invalid and therefore yield a 401 Unauthorized response. Currently, we would have to document a 404 on every authorized endpoint as well, which makes little sense.

Allow CORS with localhost

For there to be communication between front-end and back-end, CORS has to be allowed for localhost with the port 63342. (Port may be changed later)

Create posts endpoint (basic)

/resubs/{resub}/posts

Public schema:

• id
• parent resub (relation)
• title
• url
• content
• author
• timestamp created
• timestamp edited (may be null)
• list of comments
• votes (as number)

a post requires at least one of url, content

Features:

• create a new post in a resub
• get all posts in resub
• post author can delete their post
• resub owner can delete any post in their resub
• post author can edit title/description/url
• vote on post

Implement votes in database and endpoints for posts and comments

Votes table should relate to comment and posts. Models should be in repost.models.votes, and CRUD functions should be in repost.crud.votes.

Further discussion must be made to decide columns: discussion in Discord.

Implement crud to get resubs, posts and comments by user

Change content type for patch endpoints to application/patch+json to comply with Spring implementation

Implement JSON web token generation and validation

When validating, users should be verified existing in the database, but a separate issue is created for this: #18

Database model and CRUD for posts table

Model should for the most part reflect the API schema. Models should be in repost.models.posts, and CRUD functions should be in repost.crud.posts.

Further discussion must be made to decide columns: discussion in Discord.

Implement PostgreSQL database driver

This should probably be defined in repost.database. Tables don't need to be modelled yet, but the database should be able to be accessed from a future CRUD setup.

Database model and CRUD for comments table

Model should for the most part reflect the API schema. Models should be in repost.models.comments, and CRUD functions should be in repost.crud.comments.

Further discussion must be made to decide columns: discussion in Discord.

Setup docker with PostgreSQL database

https://fastapi.tiangolo.com/deployment/

Change 403 FORBIDDEN to 401 UNAUTHORIZED where it applies to authorization.

Internally, FastAPI uses 401 UNAUTHORIZED for authorization. 403 FORBIDDEN in these cases should be 401 (so we still use 403 if an authorized user tries to delete someone else's post etc)