auth flow, endpoint

[eduaravila]

• the user authenticates and authorizes with his a provider
• the provider redirects to the auth api
• the auth api gets the access token
• creates / updates the user and account if necessary
• create a jwt token / session
• store the session on db
• return the token to the user

should we save banned tokens on reddis???

[eduaravila]

{
  "self": { "href": "https://example.io/users", "rel": ["collection"] },
  "desc": "Showing 25 of 218 users.  Use the 'next' link for the next page.",
  "offset": 0,
  "limit": 25,
  "size": 218,
  "first": { "href": "https://example.io/users", "rel": ["collection"] },
  "previous": null,
  "next": { "href": "https://example.io/users?offset=25", "rel": ["collection"] },
  "last": { "href": "https://example.io/users?offset=200", "rel": ["collection"] },
  "value": [
    {
      "self": { "href": "https://example.io/users/1" },
      "firstName": "Bob",
      "lastName": "Smith",
      "birthDate": "1977-04-18"
    },
    //... items 2-24 omitted for brevity
    {
      "self": { "href": "https://example.io/users/25" },
      "firstName": "Jane",
      "lastName": "Doe",
      "birthDate": "1980-01-23"
    }
  ]
}

[eduaravila]

as a user:

• i want to log in in to the app
• i authorize the app to use my account

  test case:

• call the endpoint callback auth of the selected platform
• it should create a new user
• it should create a new account
• it should return a new session token in a httponly cookie

[eduaravila]

• brand new user
  • create an account
  • create an user
  • return a session
• already existing user
  • return account, return user
  • return a session
• already existing user logs from another account (brand new user)
  • check in the accounts for the sub
  • in theres an account, theres an user
  • return all the accounts of the user
  • return a session
• existing user authorizes another account
  • create a new account
  • link the account to the current user in the session (many [account] to one [user]) relationship