Commit Graph

40 Commits

Author SHA1 Message Date
Huyen Nguyen
ba70f5d253 feat(api): add /submit-quiz-attempt endpoint (#57201) 2024-12-06 12:45:12 -06:00
Oliver Eyton-Williams
fcedb7e98d chore(curriculum): remove upcoming python superblock (#57247) 2024-11-20 09:14:36 -08:00
Oliver Eyton-Williams
2f4e6ae8f5 refactor(api): sync dev and auth0 plugins (#57136) 2024-11-12 15:06:54 -08:00
Oliver Eyton-Williams
9c73159f10 fix(api): increase max message size for sentry (#57080) 2024-11-07 12:51:02 +01:00
Shaun Hamilton
7f1a6e553f chore(api): add request/response shadow dev tool (#56628) 2024-10-11 09:32:20 -07:00
Shaun Hamilton
916e22fd6b fix(api): allow coderoad and exam env headers (#56619) 2024-10-09 10:06:53 -07:00
Shaun Hamilton
ea44135808 feat(api): add exam-environment endpoints (#55662)
Co-authored-by: moT01 <20648924+moT01@users.noreply.github.com>
Co-authored-by: Oliver Eyton-Williams <ojeytonwilliams@gmail.com>
2024-10-04 09:20:18 -05:00
Oliver Eyton-Williams
ced457fed5 refactor: move CSRF code into plugin (#56447) 2024-10-04 12:56:04 +00:00
Oliver Eyton-Williams
cb4061c250 feat(api): redirect on error if request ACCEPTs html (#56445) 2024-10-03 16:10:25 -07:00
Oliver Eyton-Williams
609cdb0c4a feat(api): redirect auth requests if already signed in (#55829) 2024-08-14 18:53:20 +05:30
Oliver Eyton-Williams
e9ac6c5e72 fix(api): modularize auth handlers (#55671) 2024-08-08 23:05:25 +05:30
Oliver Eyton-Williams
e94080add5 feat(api): implement authorization code flow in the new api (#55413) 2024-07-24 20:08:10 +03:00
Oliver Eyton-Williams
5a00c13de4 refactor(api): use decorator to clear our cookies (#55470) 2024-07-15 10:17:40 +02:00
Oliver Eyton-Williams
bb95e2ff54 feat(api): add plugin allowing server to update cookies (#55395) 2024-07-09 07:33:04 +00:00
Oliver Eyton-Williams
bc87a56970 chore(deps): bump fastify/cookie (#55425) 2024-07-08 20:49:11 +05:30
Oliver Eyton-Williams
e8b15a255b feat(api): handle missing endpoints (#55429) 2024-07-08 13:07:16 +02:00
Oliver Eyton-Williams
766e982040 fix(api): relax cookie settings in development (#55351)
Co-authored-by: Naomi the Technomancer <accounts+github@nhcarrigan.com>
2024-07-01 08:09:39 -07:00
Shaun Hamilton
253272f35c fix(api): use HOME_LOCATION var in tests (#55386) 2024-07-01 08:06:00 -07:00
Oliver Eyton-Williams
512547e76c refactor(api): sensible default cookie config (#55227) 2024-06-27 08:44:47 +00:00
Oliver Eyton-Williams
22e74e6406 feat(api): port /confirm-email to new api (#54975)
Co-authored-by: Niraj Nandish <nirajnandish@icloud.com>
2024-06-27 10:07:53 +02:00
Oliver Eyton-Williams
4c412bff9a chore(api): remove unused session handling (#55240) 2024-06-20 20:18:16 +02:00
Oliver Eyton-Williams
84a41a4da8 feat(api): finish update-my-email endpoint (#54921)
Co-authored-by: Shaun Hamilton <shauhami020@gmail.com>
2024-06-03 09:08:42 +02:00
Oliver Eyton-Williams
6fe2b0811f fix(mailhog): use docker network address in containers (#54877) 2024-05-23 11:21:32 +02:00
Oliver Eyton-Williams
8775e9d7a1 fix: double signing test (#54171) 2024-03-26 10:11:34 +01:00
Oliver Eyton-Williams
aacfb281fb feat(api): use jwt_access_token (in development) (#53997)
Co-authored-by: Tom <20648924+moT01@users.noreply.github.com>
2024-03-20 13:47:12 +02:00
Oliver Eyton-Williams
056ac85e52 chore: delete auth0 PKCE routes (#53820) 2024-02-22 22:44:13 +05:30
Niraj Nandish
70741db619 feat(api): report user endpoint (#51170)
Co-authored-by: Oliver Eyton-Williams <ojeytonwilliams@gmail.com>
2023-10-11 20:49:05 +05:30
Oliver Eyton-Williams
25ff25e74f feat(api): remove csrf protection from get-session-user (#51615) 2023-10-03 16:17:00 -05:00
Oliver Eyton-Williams
2b5bc585a3 feat(api): sync api and api-server CORS headers (#51608) 2023-09-21 15:40:19 +02:00
Oliver Eyton-Williams
c1bc0d3f39 feat(api): handle OPTIONS requests (#51610) 2023-09-19 16:45:51 -05:00
Oliver Eyton-Williams
f3da82518a feat(api): email service (#50637)
Co-authored-by: Naomi Carrigan <nhcarrigan@gmail.com>
2023-08-04 18:57:59 -07:00
Oliver Eyton-Williams
65239ee68b feat(api): allow redirection with message (#50525)
Co-authored-by: Muhammed Mustafa <MuhammedElruby@gmail.com>
2023-06-07 15:30:12 +02:00
Oliver Eyton-Williams
30419c2e20 refactor: register fastify-sentry directly (#50622) 2023-06-06 13:45:12 +02:00
Oliver Eyton-Williams
5e17868c74 fix(api): allow fastify to set content-type dynamically (#50248)
fix: allow fastify to set content-type dynamically

We can set content-type: application/json for specific routes, but
doing so ends up with confusing, over-engineered code.

Instead we should take care when auditing the endpoints.
2023-05-02 10:15:31 -07:00
Oliver Eyton-Williams
46cdfd7802 feat(api): add CORS headers (#50120)
* test: allow mocking of env vars

Since utils/env is a module, we can mock it to control env vars in
tests. However, it's not compatible with building the server in
setupFilesAfterEnv, so, instead, we can use a utility function to keep
things DRY.

* fix: update type of fastifyTestInstance

* chore: add comment about sts preload

* chore: rename header plugin

* test: add get util + provide origin on request

* feat: add cors headers

* chore: add TODO
2023-04-26 09:02:12 +02:00
Oliver Eyton-Williams
5f12720ad2 fix: use onRequest to add headers (#50125)
* fix: use onrequest to add headers

We want to add them no-matter what, so we should use the earliest hook
available.
2023-04-24 11:08:19 +02:00
Muhammed Mustafa
daa23a3d83 feat(api): swap to immobiliarelabs sentry plugin (#50041) 2023-04-17 13:10:23 -07:00
Oliver Eyton-Williams
71d5a67745 feat(api): add security headers (#49995)
* feat(api): add security headers

Includes the OWASP recommended headers for REST APIs. Taken from
https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html#security-headers

* test: check OWASP headers appear on GET / request

* fix: only enable Strict-Transport-Security in prod
2023-04-13 10:16:58 +02:00
Muhammed Mustafa
1d8e9fb0b7 feat(api): create sentry plugin (#49731)
* feat(api): add sentry plugin

Apply suggestions from code review

Revert "feat(api): add sentry plugin"

This reverts commit fcde4ee03e9b83e335a6a2bccd490490e9993597.

install sentryNode

WIP: create sentry debug

WIP: find out why use errorhandler isn't typed correct

install sentry

add the deleted sentry code

create sentry plugin

* fix error found through sentry

* Polish sentry plugin

Co-authored-by: Niraj Nandish <nirajnandish@icloud.com>

* duplicate the changes made in the other plugin

* add done to seterrorHandler

* Fix a typo in sentry option

Co-authored-by: Naomi Carrigan <nhcarrigan@gmail.com>

* Stop the dns from running if a DSN wasn't provided

Co-authored-by: Naomi Carrigan <nhcarrigan@gmail.com>

* Polish the function and check the variable value

Co-authored-by: Oliver Eyton-Williams <ojeytonwilliams@gmail.com>

* check the dsn dashboard in the env

* export dsn value if it isn't sentrydashboard

Co-authored-by: Naomi Carrigan <nhcarrigan@gmail.com>

* when the value is undefined init errors

* revert the if statement

* throw an error whenever an environment variable is not right

---------

Co-authored-by: Niraj Nandish <nirajnandish@icloud.com>
Co-authored-by: Naomi Carrigan <nhcarrigan@gmail.com>
Co-authored-by: Oliver Eyton-Williams <ojeytonwilliams@gmail.com>
2023-04-05 08:35:23 -07:00
Oliver Eyton-Williams
a128dd8fcd chore(api): compile TS into /dist (#49812
* chore: compile TS into /dist

Having the output co-located with the source meant that the js would be
imported by default. Given that we don't recompile on source changes,
this means the server got 'stuck' at the point of compilation and would
only register changes on build.

Also, compiling to a dist directory should make it easier to build when
we want to deploy. That said, the motivation is mostly DX.

* fix: put schema.prisma in the default location
2023-03-28 19:42:20 +05:30