endlesshypnosis / build-your-own-backend

Build Your Own Backend Brewery

by Jason Lucas & Nick Svetnicka for Turing

Introduction

This application constructs an entire backend database and api using Brewery data from the Brewery DB API. This data is imported into a local .json file which is then used to seed the local database. The application also supports jwt Tokens, in which the client must request a token with a valid email address before they are allowed to make any modifications to the database.

Built With

* HTML
* CSS
* JavaScript
* Knex
* Express
* PostgreSQL
* JWT Tokens
* Chai/Mocha

API Documentation

Authentication

This API requires a JWT Token in order to modify any of the data in the BYOB database. A token must be requested through the following endpoint:

/api/v1/authenticate

The request body for the token must must include the properties appName and email

Example body for Token request:

{
    "appName": "byob",
    "email": "[email protected]"
}

Example body for Token response:

{
    "token": "eyJhbGciOiJIUzI1NiIsIeR5cCI6IkpXVCJ9.eyJlbWFpbCI6Im5pY2tAdHVyaW5nLmlvcCIsImFwcE5hbWUiOiJieW9iIiwiYWRtaW4iOmZIbHNlLCJpYXQiOjE1MDgwNDQ0MzMsImV4cCP6MTUwODIxNzIzM30.813d0w87z2x4EZUNdEbUcamDysHxM0bI31cm239algI",
    "adminVerification": true
}

This token must be included when making requests against the following endpoints:

    POST
    DELETE
    PUT
    PATCH

The token may be included in any of the following 3 methods:

• Request Body: Include the token in a property called 'token' in the body of the request.

• Authorization Header: Add an 'Authorization' header to the request with the token as the value.

• Query Parameter: Include an '?token=' query parameter to the request path with the token as value.

Authorization

The JWT Token issued to the client is 'stamped' with either admin access (ability to call API endpoints in BYOB database which modifies data), or grants access to only GET request endpoints with read-only access.

This validation is based on detection of an email address with '@turing.io'

Resources

NOTES

• The response format for all API requests is JSON format.
• Errors will be returned also as JSON objects with an 'error' property.
• The value of 'error' is the error message as a string.

HTTP Response Codes

Each response will be returned with one of the following HTTP status codes:

See documentation of individual endpoints for possible status code return values

• 200 OK The request was successful
• 201 Created The request has been fulfilled and has resulted in one or more new resources being created
• 204 No Content The server has successfully fulfilled the request and that there is no additional content to send in the response payload body
• 400 Bad Request There was a problem with the request (security, malformed, data validation, etc.)
• 403 Forbidden The credentials provided do not have permission to access the requested resource
• 404 Not found An attempt was made to access a resource that does not exist in the API
• 422 Unprocessable Entity The server understands the content type of the request entity, but was unable to process the contained instructions
• 500 Server Error An error on the server occurred

Endpoints

Authentication for JWT Token

• POST /api/v1/authenticate

Beers

• GET /api/v1/beers?abv=NUM
• GET /api/v1/beers/:id
• GET /api/v1/breweries/:id/beers
• POST /api/v1/beers
• PATCH /api/v1/beers/:id
• DELETE /api/v1/beers/:id

Breweries

• GET /api/v1/breweries
• GET /api/v1/breweries/:id
• POST /api/v1/breweries
• PUT /api/v1/breweries/:id
• DELETE /api/v1/breweries/:id

build-your-own-backend's Issues

make sure we're sending back the right status codes

our 2 DELETE are different

Create GET for /beers

configure DOTENV

npm dotenv

Think about moving server.js code for populating local json data into separate repo

Add default ABV if does not come through with the beer data

Create POST for /breweries

Refactor DELETE endpoint for brewery to delete all the beers first that are associated with that brewery

Create error handling for POST beer with invalid brewery_id

Determine what POST/PUT we want to create

Create DELETE for /beers:id

Move hard coded secret into git ignore file? or where?

GET /breweries

add admin to token

before signing, check that email ends with @turing.io.
then in in the signing, include the email property int he payload

then in all subsequent verify calls, check if admin = true;

Create DELETE for /breweries:id

Update logic to pull data from breweryDB

either pull more beers/breweries to get IDs that will match
or
create a loop for calling multiple beers for one brewery

Create POST for /beers

come up with better validation on the IDs for DELETE

Find out when to use .send vs .sendStatus...and also when/how to include json data