Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User authentication and different accounts #48

Draft
wants to merge 25 commits into
base: main
Choose a base branch
from
Draft

User authentication and different accounts #48

wants to merge 25 commits into from

Conversation

pbogre
Copy link
Owner

@pbogre pbogre commented Sep 20, 2024

Closes #43
Closes #26

This pull request aims to implement OAuth2 authentication (FastAPI docs) by implementing the following functionality:

  • users database table
  • Token creation & authentication
  • Ability to create, delete, and update users
  • Restrict Jetlog access to authenticated users
  • Login page
  • Add user field to flights
  • Personalized view of Jetlog based on user (i.e., each user sees their own flights)
  • User management settings for administrators (create/edit/delete users)
  • User management settings for users (edit own username/password)
  • Endpoint to delete users and all their flights
  • Ability to access other users' flights
  • Get SECRET_KEY from (docker) environment
  • Full backward compatibility (put all flights on first user)

@pbogre pbogre added the enhancement New feature or request label Sep 20, 2024
@pbogre
Copy link
Owner Author

pbogre commented Sep 20, 2024

Note that currently this is UNSAFE, since the SECRET_KEY variable is fixed.

Currently there is an issue where if you update your own username, your credentials will no longer be valid. To fix this I could update the token automatically when this occurs (?).

For anyone who wants to test this, the default user has username admin and password admin, and it is created once Jetlog is started and the users table is created.

Note that, so far, this change can only really be tested in the Swagger docs of Jetlog (automatically generated in 0.0.0.0:3000/docs). The ability to create and edit users is there, but it needs to be refined.

@pbogre pbogre added this to the Authentication & Users milestone Sep 22, 2024
@pbogre
Copy link
Owner Author

pbogre commented Oct 6, 2024

The latest commit supports a very basic but functional authentication system, which allows only authenticated users to access Jetlog. Next, each user should have a personalized view of Jetlog with only the flights/data relevant to them.

The current state of the code is somewhat janky, and some things that I need to work on next are:

  • Don't redirect to the login page on failed login attempts (instead, notify that credentials are wrong)
  • Don't redirect on Unauthorized requests using window.location.href = "/login"
  • Hidden characters in password input
  • Improve look of login page
  • Logout option in settings (maybe even more accessible? how?)

As progress for this feature moves forward, I am realizing that there are quite a few aspects of the code that I would like to change, for example:

  • The settings page should undergo a complete rework, with tab-based settings instead of a bunch of containers
  • The code of the class for client-side API calls is quite ugly (api.ts)

If anyone is reading this, I apologize for the long wait on this feature. I have been quite busy lately, and I don't see that changing very soon, which unfortunately means that updates will keep coming out at a slow rate. I'm doing my best to find the time to work on Jetlog.

@pbogre
Copy link
Owner Author

pbogre commented Oct 7, 2024

Aside from user management for admins, the bare functionality of this feature has mostly been implemented. Users are now able to log in and view/edit/delete/create ONLY their flights.

Some things missing from the latest commits, aside from UI improvements, are:

  • UI for admins to create/delete/edit users
  • UI for users to update own username/password
  • UI to log out

@pbogre
Copy link
Owner Author

pbogre commented Oct 30, 2024

Something I need to decide is how to handle the creation of the first user. Currently the first user is created by default and has username and password admin. This could be fine, but perhaps a better way of doing this is that, when there are no users in the users table, the first login is handled as an admin account creation. The user would of course have to be notified that since this is their first login, they are creating an account.

@pbogre
Copy link
Owner Author

pbogre commented Oct 31, 2024

Reminder to self: remove "Edit" and "Delete" buttons for normal (non-admin) users viewing someone else's flight

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

User authentication Add option to record flights for more than one user
1 participant