roymiles / cms-server

Web development project

Summary

Zeal is a web development project that allow users to create fully database driven websites without having to use any back end code. This means that there needs to be an extensive and open API for the user to query.

A javascript library will be written to query the API and synchronise the users website with their 'backend' logic securely.

At the moment, this project is in its very early stages and is a mere proof of concept. I may take this project in a different direction as I see fit.

The project is written with the Symfony2 framework and has made extensive use of their FOS bundles to speed up dev

• Note: all modules that are used on the site must be available externally via the API

TODO

General

• Generic table interface and template
• Sort table by columns
• Generic pagination widget
• Inline editable tables
• Authentication system for table edits (generic interface?)
• Remove github markdown css

Documentation

• Get JBBCode markdown working
• Breadcumb links
• Child documentation links in a widget
• BBCode for inline API responses

Javascript framework

• Integrate a secure and tested OAUTH2 library
• Create a session management service
• Get the login
• Registration system working

Small tasks

• Seperate tables for external and internal users
• Get basic API routes working with FOSRestBundle
• Get API documentation working with nelmio bundle

Testing

• Try out the built in symfony2 logging system

• Try and ensure all controllers methods have minimal number of attached routes

cms-server's Issues

Need to fix the github markdown on /docs/ pages

Make footer sticky to the bottom of the page

Tried http://stackoverflow.com/questions/16679146/force-footer-on-bottom-on-pages-with-little-content

Integrate FOSCommentBundle

• https://github.com/FriendsOfSymfony/FOSCommentBundle/
• Seems to be very flexible

Swagger annotations with NelmioApiBundle

Setup: https://github.com/nelmio/NelmioApiDocBundle/blob/master/Resources/doc/index.rst
Annotation Documentation: https://github.com/swagger-api/swagger-core/wiki/Annotations

Move all entity classes into same folder and adopt CamelCase convention globally

Using CamelCase convention for all variables, tables etc.

• Every word most have a capital first character even if its only 1 word
• Move all Entity classes into same folder and adopt ApiUsers, ApiXXX convention

Obsolete issue

Sort out logout route

Don't use "security" name for test suite, services etc (Removal)

Instead refer explicitly to the object/module

• security will be split into login/registration

Remove FOSUserBundle

• Going for custom. Too much limitations with FOSUserBundle (Plus Id instead of id :P)
• Using Site references in all other tables with -1 as the local site

Perform constrain validation in service managers

see http://symfony.com/doc/current/validation.html

User privileges system

• Users will be privileged to perform certain Actions (foreign key)
• When an action is requests, system will check if User has these privileges or is in an appropriate UserGroup that does

Move all controllers inside Api/ into Controller/ and remove libraries/Michelf

• All controllers should be in one place Api/ directory is confusing
• Using bbcode rather than markdown now

Introduce a generic bbcode inline editor

• http://www.sceditor.com/ seems promising

Brute force checks on login

• Add methods to AuthenticationManager
• Add another entity for LoginAttempts that store the Id of the user and the timestamp of the login request
• If more than 3 login attempts made within 1 minutes, block the account for 10 minutes

Create a logger class

• Used in ErrorResponsesManager
• Needs to add to the database.

Add csrf tokens to all forms / ajax requests

Get authentication system working

Traditional login form may be useful

Fix FOSUserBundle login and registration

Integrate alertify.js

• This will be used for all responses to ajax requests
• http://fabien-d.github.io/alertify.js/

Integrate FOSOAuthServerBundle

https://github.com/FriendsOfSymfony/FOSOAuthServerBundle

• It will be more maintainable and secure for authenticating api requests
• Remove sessions table as would be redundant

Remove underscore naming convention for database attributes and tables

It could prove annoying in the future considering the PHP is following a userId type convention and database is user_id

Separate the authenticators for local and api access

See: https://knpuniversity.com/screencast/guard/api-token

Make nice error pages 404, 500 etc

github.com has a cool 404 page - https://github.com/404

User management should be under admin/ and api user management under manage/users

Exceptions should return a different page if called through AJAX

AJAX request should return a json error response
Web request will return the appropriate HTML error page

Remove all Api prefixes

• Want to merge them all together

500 status code internal server error for login functional test

see: http://stackoverflow.com/questions/39321604/500-status-code-for-symfony-functional-test/39321624

Implement a universal inline mysql table editor

http://phppot.com/php/php-mysql-inline-editing-using-jquery-ajax/ - Might be useful

Start on SearchManager

This will include all the methods required to rank results based on a query

• XSS protection is important

Can't access phpmyadmin

Introduce validation for user fields

Symfony built in validation with annotations seems very flexible

• http://symfony.com/doc/current/validation.html

Validation performed in service managers (eg UserManager add(array $Options) method)

Add controllers for api user management

Check the roles are working with tokens for all pages

Integrate SCEditor

• Use custom themes and bbcodes
• http://www.sceditor.com/

Write basic user unit tests (login, registration etc)

Test the following actions:

• Unauthenticated user attempting to access restricted page (and for authenticated user)
• Login system with valid/invalid credentials
• Registration system with valid/invalid details
• Logout system
• Reset password system

Don't spend too much time on it Cover the main requirements of the system.
... For example, a test suite to see if the login system works with a long username and a valid password with the CSRF token manipulated is too specific!

Add middleware events for validating admin area, private API requests etc

http://symfony.com/doc/current/event_dispatcher/before_after_filters.html

Encoding Ids in urls

Use https://github.com/jenssegers/optimus to encode all ids from database

Separate table for external users

Why? Because would be difficult to completely customize the FOSUserbundle.
We don't want username and email field to be unique across all sites. Just across individual sites.
Logging in, registration is done with a different protocol for site users and external users.
etc..

Breadcumb links in documentation

• Links to the parent documentation up until it reaches the root (documentation with no parent)
• Root link (home) does not have a parent documentation page