Allow the eWallet to work without integration #401

unnawut · 2018-08-03T06:16:43Z

Closes #357.

Overview

This PR allows an eWallet provider to setup and uses the eWallet without having to implement or integrate into their own solutions.

Changes

Email configs

Moved Bamboo and email-related configs from AdminAPI to EWallet app (to share with EWalletAPI).
Generalized AdminAPI.Inviter into EWallet.Web.Inviter so that it accepts the email template as a parameter. So AdminAPI and EWalletAPI can send the confirmation email with different template/messages.

Authentication

Updated AdminAPI.V1.AdminUserAuthenticator to reject authentication of non-admin users
Added EWalletAPI.V1.EndUserAuthenticator to authenticate a user with email and password

Error handling

Moved :invalid_login_credentials, :invalid_email, :invite_not_found, :passwords_mismatch from AdminAPI.V1.ErrorHandler to EWallet.V1.ErrorHandler

Signup flow

Added /api/client/user.signup to support user signup with an email through the new EWalletAPI.V1.SignupController.signup/2
Added /api/client.user.verify_email to support user email verification through the new EWalletAPI.V1.SignupController.verify_email/2
Added /api/client/user.login to support user login with email/password through the new EWalletAPI.V1.AuthController.login/2

Supporting signup flow

Added a new EWalletAPI.VerificationEmail template, separated from AdminAPI.InviteEmail
Updated EWallet.Web.V1.UserAuthTokenSerializer.serialize/1 to return user along with the authentication token
Added :invite_uuid to User.update_changeset/2 so that invites can be removed after verification
Updated EWalletDB.User.has_membership?/1 to also handle user's UUID as the parameter.
Added EWalletDB.User.admin?/1

Docs

Updated OpenAPI spec with /user.login, /user.signup, /user.verify_email
Added docs/design.users.md to explain different user types and the checker functions
Added typespecs for EWalletDB.User functions

Implementation Details

Since this functionality can be built on the existing invitation system for admins (and admins are also users), most of the changes are for reusing the existing code.

Usage

Try sign up with /api/client/user.signup followed by /api/client.user/verify_email, then /api/client/user.login.

Example curl for /user.sign_up

curl 10.5.10.10:4000/api/client/user.signup \
-H "Accept: application/vnd.omisego.v1+json" \
-H "Content-Type: application/json" \
-d '{
"email": "test_signup@example.com",
"redirect_url": "http://localhost:4000/api/client/user.verify_email?email={email}&token={token}"
}' \
-v -w "\n" | jq

Example curl for /user.verify_email

curl 10.5.10.10:4000/api/client/user.verify_email \
-H "Accept: application/vnd.omisego.v1+json" \
-H "Content-Type: application/json" \
-d '{
"email": "test_signup@example.com",
"token": "kXN6Kd6HaJiYabpg7LWM3FCCHBMMLRKMBnIkMxxqjE4",
"password": "the_password",
"password_confirmation": "the_password"
}' \
-v -w "\n" | jq

Example curl for /user.login

curl 10.5.10.10:4000/api/client/user.login \
-H "Accept: application/vnd.omisego.v1+json" \
-H "Content-Type: application/json" \
-d '{
"email": "test_signup@example.com",
"password": "the_password",
}' \
-v -w "\n" | jq

Impact

Run mix ecto.migrate to migrate the database
Set the environment variable ENABLE_STANDALONE=true to enable standalone
Optionally add REDIRECT_URL_PREFIXES as a comma-separated string to allow redirect URLs that are external to the eWallet. If a redirect URL is already prefixed with BASE_URL, it does not need to be added here.

…users

…oken

…/user.login

unnawut · 2018-08-23T05:28:19Z

Remaining:

Validate success_url before creating the user, not after
Swagger update
Deprecate redirect_url in favor of verification_url
verification_url & success_url whitelist that supports http(s) + deep linking
Refactor verification_url and success_url validation to the same level
Refine error to "Your user account hasn't been confirmed yet. Please check your emails."
Retest all endpoints

…Gate

T-Dnzt

Approving with a few questions/comments :)

T-Dnzt · 2018-08-24T05:18:42Z

apps/admin_api/lib/admin_api/v1/auth/admin_user_authenticator.ex

+        Crypto.fake_verify()
+        handle_fail_auth(conn, :invalid_login_credentials)
+
+      :user_not_admin ->


Any difference between this case and the one above? Can't we juse use:

_ -> Crypto.fake_verify() handle_fail_auth(conn, :invalid_login_credentials)

You're right. Midway it was a bit different but not anymore. Updating.

T-Dnzt · 2018-08-24T05:23:45Z

apps/admin_api/lib/admin_api/v1/controllers/admin_auth_controller.ex

-
-      error ->
-        handle_error(conn, error)
+      {:error, code} when is_atom(code) ->


T-Dnzt · 2018-08-24T05:26:33Z

apps/admin_api/test/admin_api/v1/controllers/admin_auth/account_membership_controller_test.exs

@@ -257,7 +257,7 @@ defmodule AdminAPI.V1.AdminAuth.AccountMembershipControllerTest do
      assert response["data"]["code"] == "client:invalid_parameter"

      assert response["data"]["description"] ==
-               "The `redirect_url` is not allowed to be used. Got: '#{redirect_url}'."
+               "The given `redirect_url` is not allowed to be used. Got: '#{redirect_url}'."


Can we change this error to -> "The given redirect_url is not allowed. Got: '#{redirect_url}'." ?

T-Dnzt · 2018-08-24T05:30:14Z

apps/ewallet/lib/ewallet/application.ex

@@ -7,6 +7,7 @@ defmodule EWallet.Application do

  def start(_type, _args) do
    import Supervisor.Spec
+    DeferredConfig.populate(:ewallet)


T-Dnzt · 2018-08-24T05:39:36Z

apps/ewallet_api/lib/ewallet_api/emails/verification_email.ex

+  defp html(link) do
+    """
+    <p>
+      <strong>Click the link to complete the email verification: </strong>


to complete the email verification process

T-Dnzt · 2018-08-24T05:41:50Z

apps/ewallet_api/lib/ewallet_api/v1/controllers/pages/verify_email_controller.ex

+      {:error, error} ->
+        case Map.get(ErrorHandler.errors(), error) do
+          %{description: description} ->
+            text(conn, "Unable to verify your email address. " <> description)


We were unable to verify your email address. Error description: .

T-Dnzt · 2018-08-24T05:41:58Z

apps/ewallet_api/lib/ewallet_api/v1/controllers/pages/verify_email_controller.ex

+            text(conn, "Unable to verify your email address. " <> description)
+
+          nil ->
+            text(conn, "Unable to verify your email address. An unknown error occured.")


We were unable to verify your email address.

T-Dnzt · 2018-08-24T05:42:17Z

apps/ewallet_api/lib/ewallet_api/v1/controllers/pages/verify_email_controller.ex

+  Renders the page to show when email verification is successful.
+  """
+  def success(conn, _attrs) do
+    text(conn, "Your email address is successfully verified!")


Your email address has been successfully verified!

T-Dnzt · 2018-08-24T05:46:44Z

apps/ewallet_db/lib/ewallet_db/account.ex

@@ -259,14 +259,30 @@ defmodule EWalletDB.Account do
  @doc """
  Get the master account for the current wallet setup.
  """
-  @spec get_preloaded_primary_wallet(keyword()) :: %Account{} | nil
+  @spec get_master_account(keyword()) :: %Account{} | nil


T-Dnzt · 2018-08-24T05:47:54Z

apps/ewallet_db/lib/ewallet_db/invite.ex

+
+    case User.update_without_password(invite.user, %{invite_uuid: nil}) do
+      {:ok, _user} ->
+        Repo.delete(invite)


Do we actually delete invites or is it soft-delete? Can't we just set them to used or something and keep them?

It’s hard delete right now. To do soft delete, I'll do this:

Disassociate the invite from the user (user.invite_uuid) after verification. So user.invite_uuid == nil.

Add a new invite.user_uuid column to keep the user->invite trace after the disassociation from user.invite_uuid.

Add a new invite.verified_at column so it’s easy to see if and when the invite was used.

unnawut · 2018-08-24T09:00:34Z

Updated with @T-Dnzt 's comments as well as @mederic-p 's suggestion to auto-include BASE_URL as a redirect_url_prefixes

…e run

Unnawut added 6 commits August 1, 2018 15:21

Add docs to explain user types

e30b4b0

Add user type functions

c20651c

Add deferred_config to all subapps that use it

89f4dbf

Refine user docs

31b29b9

Fixes

28d7b15

Add typespecs to User

471379e

unnawut self-assigned this Aug 3, 2018

ghost added the s2/wip 🚧 label Aug 3, 2018

Unnawut added 12 commits August 3, 2018 14:48

Add /api/client/user.signup and /api/client/user.login

eb2dc1e

Move :invalid_login_credentials from AdminAPI to EWallet app

891d236

Add extra logic to AdminUserAuthenticator to authenticate only admin …

99fcd22

…users

Remove unnecessary !

30b5b10

Typo

7474b5b

Add EndUserAuthenticator

d1d36c0

auth token serializers return the authenticated user along with the t…

4c71ec6

…oken

Update AuthView to support user.json view

3f291b7

end user authenticator test

f3775a5

Update controllers to support /api/client/user.signup and /api/client…

9c40efe

…/user.login

Mix formatting

effd76e

Update yaml spec

77944b7

unnawut force-pushed the 357-standalone-ewallet branch from 3b0a7b6 to 77944b7 Compare August 7, 2018 09:59

Unnawut added 9 commits August 9, 2018 14:00

Move Mailer to EWallet

3cada28

Refactor Inviter to support multiple email templates

dff64f1

Move AuthController.signup/2 to SignupController.signup/2

a5fc71a

Add router for /user.signup and /user.verify_email

0d57177

Remove unused aliases

9ccccfb

Move Bamboo.Mailer configs to EWallet

1630481

Move /user.signup controller tests to SignupControllerTest

44462c3

Fix tests

feb188a

Add missing DeferredConfig.populate calls

0dafaec

Unnawut added 14 commits August 23, 2018 12:40

Update swagger spec for /user.signup and /user.verify_email

67c8700

Rename redirect_url to verification_url and move validation to Signup…

d13cb60

…Gate

Clean up password validation handling

b544c39

Allow multiple whitelisted prefixes for redirect URLs

ca6e6db

Fix credo errors

7001117

Sets a default REDIRECT_URL_PREFIXES vaule

5cf624b

Remove unused function

32fb25c

Generate json specs

333acdd

Fix dialyzer errors

37ea64e

Move input validations from Inviter to gates and controllers

3c94ad6

Fix incorrect typespec detected by dialyzer

c652f82

Sync AdminAuth and ProviderAuth for AccountMembershipController

e5d3bd4

Mix formatting

e69a962

Decouple EWallet.SignupGate from EWalletAPI.VerificationEmail

837dbf8

T-Dnzt approved these changes Aug 24, 2018

View reviewed changes

Unnawut added 4 commits August 24, 2018 13:23

Merged ducplicate cases

28e31d7

Human language fix

bc8c67b

REDIRECT_URL_PREFIXES should automatically include BASE_URL

a490935

Keep trace of verification email

cf77177

Unnawut added 3 commits August 24, 2018 16:20

Move mix command into migration as the ewallet require the query to b…

f7fa74d

…e run

Update env.md to say what the value should be set to ENABLE_STANDALONE

478b7df

Add env instructions for standalone

9d3568b

unnawut merged commit 6e9eb33 into master Aug 24, 2018

ghost removed the s2/wip 🚧 label Aug 24, 2018

unnawut deleted the 357-standalone-ewallet branch August 24, 2018 11:14

nebali mentioned this pull request Dec 26, 2018

Community Update 02 - August, 2018 buildOMG/comms#40

Closed

7 tasks

unnawut added flag/needs upgrade path 🛠️ This requires an upgrade path e.g. running an extra command or settings change and removed flag/needs upgrade path 🛠️ This requires an upgrade path e.g. running an extra command or settings change labels Jan 21, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow the eWallet to work without integration #401

Allow the eWallet to work without integration #401

unnawut commented Aug 3, 2018 •

edited

Loading

unnawut commented Aug 23, 2018 •

edited

Loading

T-Dnzt left a comment

T-Dnzt Aug 24, 2018

unnawut Aug 24, 2018

T-Dnzt Aug 24, 2018

T-Dnzt Aug 24, 2018

T-Dnzt Aug 24, 2018

T-Dnzt Aug 24, 2018

T-Dnzt Aug 24, 2018

T-Dnzt Aug 24, 2018

T-Dnzt Aug 24, 2018

T-Dnzt Aug 24, 2018

T-Dnzt Aug 24, 2018

unnawut Aug 24, 2018

unnawut commented Aug 24, 2018

Allow the eWallet to work without integration #401

Allow the eWallet to work without integration #401

Conversation

unnawut commented Aug 3, 2018 • edited Loading

Overview

Changes

Email configs

Authentication

Error handling

Signup flow

Supporting signup flow

Docs

Implementation Details

Usage

Example curl for /user.sign_up

Example curl for /user.verify_email

Example curl for /user.login

Impact

unnawut commented Aug 23, 2018 • edited Loading

T-Dnzt left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

unnawut commented Aug 24, 2018

unnawut commented Aug 3, 2018 •

edited

Loading

unnawut commented Aug 23, 2018 •

edited

Loading