MRPG-6 : Authentication (OAuth2) activated
MR changes
⚠ Some changes are actually not from that MR but from https://framagit.org/SGirousse/memory-rpg-backend/-/merge_requests/10 seems like gitlab has some difficulties with history comparison :/
Authentication
Now access must be done with a token :
-
POST /token
will generate a valid token- A valid user/password must be provided. For now
Admin
/_ch4ng3_M3_
|Guest
/gueguest
are valid test credentials. - It is a bearer token which must be passed to each queries
- http://localhost:8000/docs provide all capabilities to do local testing
- A valid user/password must be provided. For now
-
GET /users/me
return current user information - A dependency on validating current user has been applied on all APIs outside
main.py
Database passwords must be hashed with bcrypt
(tests passwords have been updated).
Tests
- APIs call are pushed with a valid token (based on a secret value stored on
pytest.ini
) - Each endpoint is tested with a
401
control (they must401
if token is invalid) - New methods are being tested
Documentation
Security is being documented (some parts should be completed in https://w31q1.atlassian.net/browse/MRPG-43)
Various
/characters
endpoint has been renamed /players