Created an API to login, get projects and submit timesheet

[sasithahtl]

No description provided.

[blomman9]

In order to test the code you forgot your composer.json file.
Also:

• $isLoggedIn = true; is always true.
• $auth and $request are global objects, consider initiating in code for clarity. Splitting them from the access_check.php file (also missing)
• Move $secret_key, $issuer_claim, $audience_claim to configuration file

[sasithahtl]

@blomman9 Thank you. And I have fixed the changes that you requested and now you can test the API. Please let me know if you found anything.

[sasithahtl]

created a basic small API please review.

[anuko]

What is the purpose of these lines in userlogin.php?

$_SESSION['date'] = $current_user_date;

setcookie('tt_login', $cl_login, time() + COOKIE_EXPIRE, '/');

[sasithahtl]

Changed as requested. Please review again!

[blomman9]

Please don't make the files executable.

chmod 644 WEB-INF/config.php.dist
chmod 644 api/projects.php  
chmod 644 api/submitTime.php
chmod 644 api/userlogin.php

Also please add vendor to .gitignore file
echo "vendor" >> .gitignore

Remove file @include('../plugins/limit/access_check.php'); from line 36 in userlogin.php

With regards to input validation on submitTime.php
The value of $cl_project = $object->projectId; should be checked against $project_list = $user->getAssignedProjects(); to exist to be allowed time report, also good to do sanitation of input (floatval($cl_duration) although floats are not allowed by function and filter_var($cl_note, FILTER_SANITIZE_STRING))).

[anuko]

Closing the PR as some minimalist API is already provided by ttapi servlet that works directly with Time Tracker database. Anuko Time Tracker Android App uses it. Currently it is for for access to shared Time Tracker server hosted by Anuko. Eventually things may be open-sourced.

[blomman9]

Hi @anuko I was really looking forward to this API especially using JWT.

I read there is no way to invalidate a token once its commissioned, but it makes sense in an app over API calls that potentially can be logged, to issue time based tokens such as JWT (and not solely rely on session or cookie).

Will you reconsider? I can take another look at the MR if you want to.