ftsell / borrowlist3000 Goto Github PK

If someones wishes to self-host this application, they might not want random people to create accounts on their instance.

In this case, the user should be able to disable arbitrary user registration however it is not yet clear how any new users would be created in that scenario.

Currently, the frontpage statically redirects to /app.
It should instead display some information about the application and more prominently link to available resources such as this Github repository.

Currently, sequelize.sync() is called which sets up database tables if they don't yet exist.
This however, does not scale well because it completely ignores later changes to models.

Instead, a migration library like Umzug should be used.

A user should be able to have an overview of their account that includes the following information and features:

• Change password feature
• Delete account feature
• E-Mail address settings, see #7 for details

• Configuration reference (environment variables)
• Link to public instance
• Summary of project architecture
• Deployment guides

Observing the public instance at borrowlist.dreitausend.eu you can see that the session cookie is set without the secure cookie attribute even though it should.

As far as I know express-session should automatically set the secure attribute when the application is accessed through https so this might be a result of proxy trust not being correctly configured.

The application is designed to keep track of who borrowed what stuff.
It would be nice if a user could send a link to the application to the borrower who can then also view what they have borrowed (i.e. as a reminder).

This should be implemented without requiring the borrower to log in to the application.

On the authentication page should be a button that triggers a password reset in case a user forgets theirs.

Currently, the session cookie has no lifetime set so it expires as soon as the user closes the application tab (or the browser, i don't really know).
This should be easily correctable by defining a cookie lifetime as documented in express-session

Sometimes a user might not wish to fully register via username and password.
In this case it should still be possible to use the application via an anonymous account.
The access credentials for that anonymous account should then be saved on the users browser so that they are able to access the account again.

With modern progressive-web-app standard it should be possible to mostly use this application offline.

If a complete synchronization solution turns out to be too complicated, it would also be nice to use the application in a read-only mode when offline.

Currently, the application uses vuetify as a component library but neither defines a color scheme nor uses any colors.
Additionally, the current user workflow was hacked together to be something that works.

Ideally, the User-Experience should be revisited to make it better.

Sometimes a user might lose access to their account.
In this case, there should be the functionality to recover that access by sending a recovery link to an email address linked to their account.

Of course it should still not be necessary to provide an email address for registration but voluntary.