zenika / proxybeez

Proxy to the Alibeez API. Handles tenant multiplexing and per-client access management.

ZeniLunch

Trop dur de choisir où manger le midi, enfin ça c'était avant cette application Android.

Lien vers la maquette Figma : https://www.figma.com/file/zTOajuYZ2MYCohjXHeSJuA/ZeniLunch?node-id=0%3A1&t=MHQir7ZKVIQ3yg5d-1

proxybeez's Issues

Include top-level executives in current employees endpoint

See #6. Currently the endpoint does not return top level executives because they are not of type "EMPLOYEE" in Alibeez. Problem is that removing the filter on type==EMPLOYEE pulls contractors.

Need to discuss with Alibeez.

Erreur 500 quand on requête les utilisateurs Alibeez via Tyk

Allow proxybeez to retrieve employees timesheets

In order to deploy our JAZ police application we need to access per agency the different kind of JAZ a user may take. This issue will first serve to define how to implement the required modifications in Proxybeez. It will then be linked to a a pull request containing implementation.

What informations do we need ?

For each employee, we want to have for each month the detail of the various tasks they have done (in fact, we simply want the full timesheet).

We also want to access to the list of tasks considered as JAZ (the content of which is displayed in the page allowing an employee to take a JAZ)

How will it be consumed

We will access those informations from the JAZ police backend through planned tasks (I will reluctantly admit this is a synonym for batches).

• one planned task will get all employees timesheets daily

• one planned task will get all JAZ tasks monthly

• Will that backend require an API access key to access Proxybeez ?

Allow authentication by Authorization header

Authentication is currently done through the token query parameter (see https://github.com/Zenika/Proxybeez/blob/master/src/main/java/com/zenika/proxybeez/config/SecurityConfiguration.java#L109). It would more secure to use the Authorization header instead, because URLs are often logged, while the Authorization header is designed to carry secret info and third-parties handle it as such. The token query param method should still work, for compatibility.

Add an anonymized access

Currently, the only way to request data from Proxybeez is too ask for a key and have a good reason to use the data. It would be useful for dev to have a version of the API that can be requested without a key, but that only has anonymous data (no names, no emails).

However we probably don't want to open this API to the internet so we need 2 types of keys. Can Tyk manage that for us?