internetee / auction_center Goto Github PK
View Code? Open in Web Editor NEWEstonian Internet Foundation's software for auctioning domain names
License: Other
Estonian Internet Foundation's software for auctioning domain names
License: Other
We are running on rails 5.2.1 that is marked vulnerable to the CVE-2019-5418.
Although we do not have file rendering on auction center it might still be a good idea to consider updating the rails version
Once the UI has been stabilized, remove unused Javascript modules from app/javascript/src/semantic-ui. We currently use only a few and there is no need to have them all in the repository.
This would be great even if your organization does not intend to use it to offer paypal as a means of payment in a code option
Certain aspects of the application, such as "how big should be the initial price of a domain" should be stored in Settings that are available to the administrator to change at any point in the running application.
Certain pages might need pagination:
Implement it either with some gem like Kaminari or by hand.
Invoice cancellation job tries to cancel invoices already in "cancelled" state. It should not do that.
The issue can be observed on staging.
We need some kind of staging deployment to make sure the functionality we develop is in order.
The goal is to have it complete separate from registry. Can live on separate machine, separate database instance etc.
if a new user tries to make a bid with no billing profiles an error is returned. As all defined users are private persons and nationality is one of the mandatory parameters upon creating the user there is no need to require billing profile unless the user wants the invoice in the name of a company.
Also as discussed the billing profile is only related to invoicing and thus does not come into play before the user's bid has actually won. So the user should be able to set the billing data on the invoice and no such choice needs to be made on making the bid.
When a user creates an account she needs to:
Allow a user to edit their profile:
Allow auctions to be ended at the end of the same calendar day in the application designated timezone.
When this is set up, auction should always end at 23:59:59, regardless of at what time they started.
adding phone number on creating a new user might get confusing as there is no hint on the required format. If user enters just the phone number part without the country code the error "moible phone is invalid" is returned but there is nothing that says what exaclty is the cause or what should the correct phone number look like.
Ideally there should be some hint in the UI that would help user to use the correct format to begin with. Also error message should indicate the what is the correct format.
There is an ietf epp allocation token draft that could work in our case:
https://datatracker.ietf.org/doc/draft-ietf-regext-allocation-token/?include_text=1
Domain list view will be available on the web page:
short list in index: https://eis-dev.voog.com/
and full list on separate page: https://eis-dev.voog.com/domeenid/domeenioksjonid
so the blue domain list view of the auction center should be moved behind login barrier and painted green (should be the index page opened after logging in). https://auction.infra.tld.ee/auctions
From the full list view on the EIS web page will point directly to bidding view /uid/offers/new
Add a way to configure Airbrake/Errbit in environments
Domain must be registered x days after the invoice payment. Currently it is after the auction has finished.
Extracted from #1 as there's a lot of work to be done here.
Allow to:
Require:
Allow to:
Require:
Use:
By default highest bidder wins.
In the case of multiple identical highest bids the tiebreaker is required. Preferred solution here is random selection. Need a trustworthy random number generation.
Country selection in any form should be dropdown
/billing_profiles/new
/billing_profiles/1/edit
When a user reloads the search page, it loads a 404. Instead, it should re-send the same post request with a search form.
There should be some kind of message on user creation and user data email address editing notifying that confirmation letter has been sent and user has to go and confirm it before the user is activated or email address update finalized. Currently user is notified only on trying to login with unconfirmed user or going back to edit user view.
At any given point, a user can delete their account. We should delete that account, but retain related records such as history of offers that user made and auctions that user has won.
Currently, mobile/sidebar menu is disabled because it didn't work properly and did not use semantic ui functions. Needs to be fixed as soon as we get input from the contractor.
System does not allow adding multiple billing profiles with the same vat code in the system. While this is OK for a single user it is not for the whole system as every organisatsion can have multiple representatives.
At the same time adding a billing profile must not give access to any of the invoices assigned to that company (bids are done by a unique users and only that user has access to the billing and authorisation code related to the winning bid)
Also error handlung is missing for adding multiple profiles with the same vat code for the same user - error 500 is returned.
Create basis for WebSocket communication. It would allow us to do the following:
In the email to the auction winner there is a link to the invoice, but the invoice that directs user to 404
example link: http://auction.infra.tld.ee/results/7
actual url uses uuid instead of the one char id to point to the invoice
Allow to:
description for registration_term parameter says:
Number of days before the auctioned domain must be registered, starting from the auction start. Default: 14
while in reality the count starts from the time resgistration code was issued/released
An administrator can:
Starting price does not affect:
Needs Money-like object class.
Use delayed_job for processing tasks that require background processing:
The reason why we should go with delayed_job
, and not sidekiq
is that the latter does only support redis as backend, thus adding one more infrastructure element that needs to be managed and updated.
Allow to keep history of all the changes to database records that happen during the application lifecycle. Given the general discontent with paper_trail
gem, we probably should use postgres triggers instead.
A user can have multiple billing profiles, for a private person as well as any company they might represent.
rails new
Update delayed_job settings to retry 3 times, not 25. Investigate additional settings
Currently, users coming from electronic identity documents also need to set up password and then be allowed to log in with email and password. This should be reworked:
Send short registration codes to person's mobile phone number to confirm that their accounts are safe to activate.
Requires a feature flag (not all perspective users will need that) and an implementation that is blind to usage of a specific partner like Twilio, Messente or other.
Tentative:
Any time I create new profile the form is perfilled name field with the users name.
Another problem is that the same happens on editing existing profile so that upon saving the profile edit the name is changed
Add the following email notifications, from start to finish of the process.
Implement ban/block lists for users:
When user creates or updates an account, validate that:
Currently applicable only to Estonian data.
Based on data obtained from #2, allow to search by domain name.
When a non-e-IDAS customer wants to submit an offer, submit them to entering captcha.
Requires manual changes in staging.
Before going live, the billing profile's country code field needs to be set to not null.
Introduced in #40
Allow the table to display strings of at least 26 characters (IBAN).
Allow:
Actual implementation details to follow once the Registry API is decided.
We should provide the following search options:
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.