Skip to content

MRPG-6 : Authentication (OAuth2) activated

Siméon Braga-Girousse requested to merge feature/mrpg-6 into main

MR changes

Some changes are actually not from that MR but from https://framagit.org/SGirousse/memory-rpg-backend/-/merge_requests/10 seems like gitlab has some difficulties with history comparison :/

Authentication

Activated

Now access must be done with a token :

  • POST /token will generate a valid token
    • A valid user/password must be provided. For now Admin/_ch4ng3_M3_ | Guest/gueguest are valid test credentials.
    • It is a bearer token which must be passed to each queries
    • http://localhost:8000/docs provide all capabilities to do local testing
  • GET /users/me return current user information
  • A dependency on validating current user has been applied on all APIs outside main.py

Database passwords must be hashed with bcrypt (tests passwords have been updated).

Tests

100% (+) test coverage :

  • APIs call are pushed with a valid token (based on a secret value stored on pytest.ini)
  • Each endpoint is tested with a 401 control (they must 401 if token is invalid)
  • New methods are being tested

Documentation

Security is being documented (some parts should be completed in https://w31q1.atlassian.net/browse/MRPG-43)

Various

/characters endpoint has been renamed /players

Merge request reports