Skip to content
This repository has been archived by the owner on May 22, 2021. It is now read-only.

Latest commit

 

History

History
144 lines (121 loc) · 4.36 KB

conceptmeeting-20200420.md

File metadata and controls

144 lines (121 loc) · 4.36 KB

Home > Changelog > Meeting Changelog

Conept Meeting - 20. April 2020

1. Login

  • Credentials
    • Students
      • Email & Password
    • Teacher
      • Email & Password
      • Teacher Token (Register)

2. Profile

  • No profile pictures (yet)
  • No nicknames (yet)
  • Option to set real first- and lastname for certificates etc.

3. Referral link

  • Bonus points for the person
    • We should save the relations between these persons
  • Fake Account Protection
    • Community points legitimate a specific user

4. Role

  • Admins can create tasks
  • Everyone else can try these tasks

5. Authentication

  • We wanted to refine the authentication concept - postponed
    • User MS
      • The user ms shows inactivity since 25days (state 20. April)
      • The service itself lacks a lot of features
    • The gateway currently is more capable of authenticating users than the user ms
    • We had some thoughts about implementing an email user micro service
    • JWT
      • userId
        • iss ("e-edu")
        • iat (64bit Unix Timestamp UTC as String)
        • exp (64bit Unix Timestamp UTC as String | 15min lifetime)
        • scopes (string[])
          • structure: microService.topic.mode.extra
          • "task.subject.create"
            • Gives the user/role permission to create subjects
          • "task.subject.read"
            • Gives the user/role permission to read subjects
          • "task.subject.read.beta"
            • Gives the user/role permission to read beta subjects
          • "task.task.write.verify"
            • Gives the user/role permission to verify tasks
    • JWTs should never contain sensitive information
      • status ("banned" f.e.)
    • Rough concept
      • Browser sends login/register request to backend (with deviceId)
      • backend responds with refreshToken (http only; secure) | frontend has to do nothing in case of 200
      • on every request there is the chance, that the CSRF token is not yet available or expired
        • server responds with "csrf expired"
        • browser starts a request to the jwt mutation
        • the backend responds with the csrf in the body which is valid for 15 minutes and will be set by the javascript (never store it in a cookie) in a header

TODO: RefreshToken, Frontend- & Backend Hashing, DeviceTokens, Protections

6. PubSub

  • Encoding
    • JSON (not pretty printed)
  • Topic
    • microservice.topic.extra.extra2.extraN
  • Example
    • report.user.ban
      • userId
      • reason (string)
      • scopes // see #5 -> JWT
      • author (user who banned the user)
        • (authorId)
        • (authorName) // only used for intern names
          • auto ban = "system"

7. Next meetings

  • The concept team tries to have meetings every monday 8pm UTC in Discord
    • You need something to be refined? -> Create an issue in the concept repository or write into the #Konzept-doku channel in Discord

8. Roles & Permissions

  • scopes (string[])

    • structure: microService.topic.mode.scope.extra
      • concetination is allowed
        • "task.subjects+module+lecture.read.all+beta"
          • should be stored seperately in the database
          • only use this format for data transfer
      • mode
        • read
        • write
        • delete
      • scope
        • none (default)
        • own
        • self (only applicable to topics regarding the user itself)
        • all
        • beta
      • extra
        • extra information (if needed)
    • "task.subject.create"
      • Gives the user/role permission to create subjects
    • "task.subject.read"
      • Gives the user/role permission to read subjects
    • "task.subject.read.beta"
      • Gives the user/role permission to read beta subjects
    • "task.task.write.verify"
      • Gives the user/role permission to verify tasks

  • roles

    • student
      • user.user.write.self
      • user.user.delete.self
      • task.subject.read.all
      • task.module.read.all
      • task.lecture.read.all
      • task.lectureGroup.read.all
      • task.task.read
    • admin
      • user.user.read+write+delete.all+beta
      • task.subject.read+write+delete.all+beta
      • task.module.read+write+delete.all+beta
      • task.lecture.read+write+delete.all+beta
      • task.lectureGroup.read+write+delete.all+beta
      • task.task.read+write+delete.all+beta

9. DSGVO

  • export data
    • json
    • pretty printing not needed
  • document why, where and which data is collected/processed
  • delete data

TODO: Do we have to delete or is anonymization enough?

Home