HTTP APIs for Bedrock User Accounts
digitalbazaar / bedrock-account-http Goto Github PK
View Code? Open in Web Editor NEWHTTP APIs for Bedrock User Accounts
License: Other
HTTP APIs for Bedrock User Accounts
License: Other
Many peerDepedencies
of this package have recently received a major release.
In particular peerDepedencies
will need to follow this pattern lastRelease.x - latestRelease.x
.
Documentation on peerDeps can be found here: https://nodejs.org/en/blog/npm/peer-dependencies/
The latest major releases are:
bedrock-kms: ^3.0.0
bedrock-edv-storage: ^3.0.0
bedrock-session-mongodb: ^4.0.0
bedrock-identity: ^8.0.0
bedrock-vc-issuer: ^4.0.0
bedrock-ssm-mongodb: ^3.0.0
bedrock-zcap-storage: ^3.0.0
bedrock-authn-token: ^2.0.0
bedrock-profile: ^5.00
bedrock-account: ^3.0.0
bedrock-permission: ^3.0.0
You will also need to upgrade the test project.
This should require 2 steps:
.github/workflows/main.yml
so that MongoDb is version 4.2This Draft PR can be used a model: digitalbazaar/bedrock-kms-http#25
Current Tests just set permissions directly via a stub of the passport method that sets req.user.
We want to remove that make sure the actor set by the stub actually really has access to the account.
Moving this out for later refactoring and providing some context around what the "token" is and what it's for:
if(cfg.registration.authorizationRequired.length > 0) {
await _authorizeRegistration({req});
}
Down below where helpers are defined:
async function _authorizeRegistration({req}) {
const cfg = config['account-http'];
const {authorizationRequired} = cfg.registration;
const {authorization} = req.body;
if(!(authorization?.type === authorizationRequired &&
authorization.token)) {
throw new BedrockError(
`Authorization using "${authorizationRequired}" is required.`, {
name: 'NotAllowedError',
details: {
httpStatusCode: 403,
public: true
}
});
}
const remoteIp = req.socket.remoteAddress;
await _verifyTurnstileToken({token: authorization.token, remoteIp});
}
Since the above fits the middleware pattern, I'll file an issue about potentially making this a middleware in the future.
I'm also not sure if using req.socket.remoteAddress
is will work in deployment scenarios -- we'll need to figure that out before merging the PR to make sure we're pulling the IP from the right place.
Originally posted by @dlongley in #42 (comment)
We need the ability to search for accounts by email address. This in turn requires the following features in bedrock-account-http:
this should help:
https://github.com/digitalbazaar/p3/blob/master/lib/payswarm-auth/services.transaction.js#L730
https://www.dataversity.net/introduction-linked-data-platform/
This comes from the spec the expected feature is:
Add user account
currently an admin can create an account by posting an email address to the basePath
this results in a bedrock-account emitting an account.insert event.
My proposal for this feature is:
the alternative would be to handle this somewhere else via the bedrock account.insert event.
The google Docs for getAll specified only search by email.
@mattcollier @gannan08 both want to expand this search functionality.
even the wireframe expects search by more than just email.
so we could refactor:
in the future we could expand to search by credentials / persona
this would allow search by phone number, last name, first name, etc.
We are adding optional captcha-style authz for account registration -- and we should ensure we have negative tests for this. Negative tests should include both missing and invalid authz params in a request. This includes ensuring that token verification will fail for a bad token that is otherwise well formed.
TODO extend mocha should with this
Commit: (2bdc2dc) Add validation and tests for all working routes.
File: test/mocha/10-api.js:30
Andrew Jones commented a year ago
TODO: next
Commit: (64213dc) Add core files.
File: lib/index.js:225
Dave Longley commented 2 years ago
TODO: improve error details
Commit: (2bdc2dc) Add validation and tests for all working routes.
File: lib/index.js:117
Andrew Jones commented a year ago
FIXME add an implementation in bedrock-express
Commit: (2bdc2dc) Add validation and tests for all working routes.
File: lib/index.js:92
Andrew Jones commented a year ago
TODO: if passport supports promises or this can be safely promisified
Commit: (c637816) Add TODO.
File: lib/index.js:71
Dave Longley commented 3 months ago
FIXME add an implementation in bedrock-express
Commit: (2bdc2dc) Add validation and tests for all working routes.
File: lib/index.js:17
Andrew Jones commented a year ago
Looks like a copy-paste error that defaults actor
to null
here:
https://github.com/digitalbazaar/bedrock-account-http/blob/master/lib/index.js#L96
That will prevent permission checks from being run -- the null
default should be removed so actor
will be undefined
, causing the permission check to fail, as it should, when someone tries to read an account without authenticating.
Testing out the route in actual Vue and found that it returns password sha-256 etc.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.