Step 2.b: Validate and update Concordium account

[jatitoam]

Add a new endpoint /prerregistration/id/:id/account/:account/?signature=<signature> (PUT) similar to the demo, to validate if it's the actual owner of the account who signed the request (watch https://github.com/aesirxio/web3-id-preregistration-backend/issues/3) and to link it to a web3 id in the preregistration collection.

If any validation fails, it needs to send a 4xx http code with a json:

{
   "error": "<specific message>"
}

Possible validations:

• Missing signature: 406
• Signature not base64: 406
• Signature not json: 406
• Invalid signature (using concordium sdk): 403
• Invalid format of the account (regex): 406
• Account does not exist in the account collection: 404
• Id not found in the preregistration collection: 404
• Id already linked to another account in the preregistration collection: 406

Important: After signature verification (using concordium-sdk) the nonce needs to be cleared in the account document. This needs to happen regardless of validation pass or fail.

If all validations pass, then it needs to modify the preregistration document (finding by id) to add the a new field account which needs to be the one sent. It will return a json (with 201 http code)

{
   "result": "true"
}

[CongThuong]

Please how can I check "Id already linked to another account in the preregistration collection: 406" while in task:#2 we don't know and save account in its table? @jatitoam

[jatitoam]

the validation of the account is against the account collection as it was stored in #3

[jatitoam]

wait, two things:

404 if the account does not exist in the accounts collection 406 if the account is already linked to another pre registration document, because this 2.b action was already performed for the same account linking it to a different id, in other words: pre registration cannot repeat ids not accounts

[CongThuong]

How about the nonce needs to be cleared in the account document? So we define this field NOT required? right? @jatitoam

[jatitoam]

correct it has to be cleared for security purposes so it can only be used once (nonce)

[jatitoam]

also remember that in MongoDB there are no required fields in reality, it's just a convention

[thaoredweb]

@CongThuong please help me to get the signature e cc @jatitoam

[thaoredweb]

@jatitoam I skip this task at local. I can not get the signature at local that is a param in {{domain}}/preregistration/id/:id/account/:account/?signature={{signature}}