Ensure that a single security check passing results in the entire check passing.
Ensure that the data from all successful security checks is available to downstream handlers.
Add rate limiting to create-plan operation
Add rate limiting to create-plan operation. A given IP can only create 1 plan every 24h.
Insert creator IP address during plan creation.
Add most-recent-plan-created-by-ip-address DB query in db.plans.
Update HTTP OpenAPI security logic such that a single successful authentication option results in end-result authentication success (extant behavior) yet all authentication options are permitted to run (new behavior).
This lets us have optional authentication on endpoints while still getting the authentication data in the request context when an optional authentication mechanism has passed.
Add plan creation rate limiting E2E test in bootstrap-test.
Migration: add created_by_ip_address text column on plans table
Purpose of column is for rate limiting plan creation based on IP address.
Add DB index plans_created_by_ip_address_created_at_idx on plans table on (created_by_ip_address, created_at).
Add rate limiting to create-user endpoint.
Add rate limiting to create-user endpoint (POST /users). An unauthenticated request from IP address X can only create a new user once every 12 hours.
Note that nothing prevents the unauthenticated user from creating subsequent users WHILE authenticated. This is because we want authenticated users to be able to create users as often as they need. Further rate limiting around plan creation is probably needed.
Add users/most-recent-user-created-by-ip-address DB fn / HugSQL query. It returns the most recently created user with the supplied :created-by-ip-address value and which was created anonymously. Useful for rate-limiting authentication-less user signup.
Support :too-many-requests error code in common errors ns.
Add dependency circleci/bond "0.6.0".
Migration: add created_by_ip_address text column on users table
Purpose of column is for rate limiting user creation based on IP address.
Add DB index created_by_ip_address_created_at_idx on users table on (created_by_ip_address, created_at).
Stub out email (sending) system component.
Remove deprecated DB system ns.
Add ability to reset a user's password
Introduce two new API endpoints: initiate-password-reset & reset-password.
Fix bug in openapi.handle where 204 responses that expect no body were incorrectly throwing.
Changes
Rate limiting, OpenAPI security & password reset: