Closed lonkaars closed 3 years ago
The code has been audited, and pretty much all endpoints, and even the socket.io event listeners are using decorators from api/hierarchy.py. I'll now start with updating and finishing the documentation.
I've updated the documentation in api/readme.md, and modified dprint.json to use space tabs in python even though I think spaces are hideous. I'll close this issue for now because I think the api code is safe enough right now, though I will be writing unit tests soon.
A lot of the backend code is pretty spaghetti because it was sort of rushed in order to reach the deadline. Some authentication code is repeated, and socket.io event handlers don't all properly check for authentication. Here's how the authentication decorators should work after the audit (all of them will be defined in api/hierarchy.py)
If possible these decorators should also work for socket.io event handlers.
If the decorator finds that a token is invalid, or something else happens that doesn't allow the wrapped function to be ran, it should return an empty response along with one of the following http status codes:
As part of the API code audit, the documentation should also be updated and finished in api/readme.md, and another table for commonly used utility functions and decorators should also be created so it's easier to write new endpoints.