product-os/jellyfish

The Jellyfish Project

jellyfish's Issues

User created views should be 'personal'

Users should be able to see their own views

Add paging to view results

On logout, clear the user's session token from the SDK

Use the SDK for testing permissions

Community chat should filter chat messages not chat threads

Currently the community chat view filters for chat threads, ideally it should just show all chat messages that the user can see. To implement this we will need to ensure that community users cannot see chat messages that are attached to cards that they cannot see, so there is a requirement on #153

Create and update events are always created by the actions user

When creating and updating a card, I would expect the card's timeline to credit the user who initiated the create or update action to be the actor shown on the timeline. Instead the actor for update and create cards is always the actions user.
This makes using the timeline as an audit trail impossible, as we can't tell which user did what.

Signup form should use the same validation logic as the user card

Check user write permissions in client

User write permission should be checked client side to determine if an action on a card is available or what fields on a card can be edited.

View cards should specify which lenses it utilises

At the moment, suitable lenses are detected automatically. We should change this so that lenses are specified by the view card

Add support for custom `semver` and `semver-range` string formats

It would be very useful to extend json-schema to support semver and semver-range formats

If a user's session is invalid, they should be returned to the login screen

Don’t override default cards that you modified when starting the server again

Improve SDK card methods

You should be able to add arbitrary data to a Card

Currently, you can only add fields to a card that are defined in that card type's schema.

Users should not be able to change another users password

Currently, logged in users can change other users passwords

await sdk.card.update('USER_ID', { 
  data: {
    password: { 
      hash: '6dafdadfffffffaaaaa' 
    } 
  } 
})

The SDK should cancel all network requests and close all streams on logout

Fix Bluebird warning in gravatar component

After logging in, the following warning can be seen in the console

Warning: a promise was created in a handler at http://localhost:9000/bundle.js:144116:16 but was not returned from it, see http://goo.gl/rRqMUw
    at new Promise (http://localhost:9000/bundle.js:17705:10)
    at getGravatar (http://localhost:9000/bundle.js:584:12)
    at Gravatar../lib/ui/components/Gravatar.tsx.Gravatar.load (http://localhost:9000/bundle.js:616:9)
    at Gravatar../lib/ui/components/Gravatar.tsx.Gravatar.componentWillReceiveProps (http://localhost:9000/bundle.js:607:22)
    at callComponentWillReceiveProps (http://localhost:9000/bundle.js:92665:16)
    at updateClassInstance (http://localhost:9000/bundle.js:92905:9)
    at updateClassComponent (http://localhost:9000/bundle.js:94118:22)
    at beginWork (http://localhost:9000/bundle.js:94755:16)
    at performUnitOfWork (http://localhost:9000/bundle.js:97587:16)
    at workLoop (http://localhost:9000/bundle.js:97616:26)
    at renderRoot (http://localhost:9000/bundle.js:97647:9)
    at performWorkOnRoot (http://localhost:9000/bundle.js:98222:24)
    at performWork (http://localhost:9000/bundle.js:98143:9)
    at performSyncWork (http://localhost:9000/bundle.js:98120:5)
    at requestWork (http://localhost:9000/bundle.js:98020:7)
    at scheduleWorkImpl (http://localhost:9000/bundle.js:97895:13)
    at scheduleWork (http://localhost:9000/bundle.js:97855:12)
    at Object.enqueueSetState (http://localhost:9000/bundle.js:92417:7)
    at Connect../node_modules/react/cjs/react.development.js.Component.setState (http://localhost:9000/bundle.js:145193:16)

Add a virtual "timeline" property to cards

The purpose is to be able to expand it to perform queries based on the timeline of a card.

See https://www.flowdock.com/app/rulemotion/p-cyclops/threads/YWRCmqSqxS-0SYrYa5_MXX3ftd3

Write default contracts with JSONNet

http://jsonnet.org/learning/getting_started.html

Update UI to latest wireframes

Ensure that all data returned from the server is run through the `jsonSchema.filter` method

Th jsonSchema.filter method is using the removeAdditional option in AJV ( https://github.com/epoberezkin/ajv#filtering-data ), which, when combined with user permissions allows us to whitelist fields. This is very useful for doing thing like stopping users from viewing other users password hashes.
At the moment, not every query result gets run through the filter function which means there may be cases where a malicious user could see data they are not meant to ( getElementBySlug, getElementById etc)

View and lens preferences should be preserved on page reload

Stored session state should be checked for corruption on load

UI state stored in localstorage should be treated as untrusted and validated on load

Reload UI config on page reload

At the moment configuration like Type cards is stored in LocalStorage and only gets reloaded if you logout and log back in again. This data should be refreshed on page reload and automatically via a socket connection.

Add tests for UI components

There is a good guide for testing React + TypeScript using Ava and Enzyme here https://semaphoreci.com/community/tutorials/testing-react-components-with-ava

`utils.waitForMatch` can hang indefinitely

utils.waitForMatch can hang indefinitely if a matching card is created whilst the stream is initialising. To resolve this, a query for matching cards should be run once the stream is initialised, similar to how the actions server does it.

You should be able to create new views

You should be able to create new views, or extend an existing view

Move `/login` endpoint to client SDK

Clicking the 'active cards' view kills the UI

Add error handling and notifications

We need to add error handling for sockets and API requests

Expose read/write permissions filters JSON schemas to client

This can be particularly useful to determine, client side, what type of card we should create given a certain active view.

Chat messages are created twice in production

When adding a new chat message, its created twice

Add tslint and lint typescript files as part of test step

Tests can fail if server fails to bind to a port

Move SDK to lib/sdk

Show useful error message on login screen

Currently there is no message shown if you enter the wrong login details

If a user cannot view a 'head' card they should not be able to view its timeline

If a user cannot view a card they should not be able to view any cards that are attached to it.
For example a card of type repo can have cards of type update, create and chat-message cards that target it. If a user cannot view the repo card, they should not be able to see any of these cards.

User's cannot see create and update actions on a card

Implement a proper JSONSchema to Reql translator

Currently, when a query is run, we filter the results on the server using JSONSchema.
This solution won't scale well and we need to be converting JSONSchema directly into Reql queries.

Add license headers to SDK files

Allow users to mention other users

Users should be able to use @ to mention other users. Messages they are mentioned in should be shown in a new view

Users should be able to subscribe to a view and receive notifications when it changes

Allow users to change between view 'groups'

If a view has multiple groups available, the user should be able to choose between them

Separate redux store from SDK

Add JSdoc comments to SDK files

Improve signup UX

At the moment, its not obvious that signup has worked. Additionally we should make sure you can't signup with the same email/username

Add routing to represent application state

Ensure that event component retrieves username from cache

If the client is in an 'unauthorized' state, their token should not be used for requests

Add a `whoami` SDK method for retrieving user information