Journalist API v2

[redshiftzero]

Description

this is a list of endpoints we want to change/modify/add for the next version of the journalist API:

• GET /sources should only grab source metadata without key information (see us needing to memoize CryptoUtil.getkey in Cache CryptoUtil.getkey (redshiftzero's idea) #5100 to make the v1 version fast enough for the beta workstation release)
• GET /sources should omit the number of submissions/replies
• add a GET /sources/<source_uuid>/key endpoint that gets the key details
• ... more soon

note: this ticket right now is just for ideas and needs further discussion prior to implementation

[eloquence]

For more effective sync, we'll also want to consider ideas like:

• storing and serving a global last_updated timestamp via its own endpoint so that the client can determine whether a full sync is necessary, or
• serving a full changes feed (will have to cover changes to old sources like replies, deletions, key generation events)

[prateekj117]

@redshiftzero @kushaldas @eloquence I would love to start some work on API v2. Let me know if I can start some work on it.

[eloquence]

Flagging for in-depth discussion at a future tech mtg, potentially followed by a clearer requirements spec.

[gonzalo-bulnes]

serving a full changes feed (will have to cover changes to old sources like replies, deletions, key generation events)

I'd like to hear more about this idea @eloquence! (My first thoughts are: would that involve comparing two states? Would the clients have to provide some information about their own current state, or the last state they retrieved?)

I got here from freedomofpress/securedrop-client#1285 (comment)