Setting up accounting

[pdonorio]

This is probably served well with Flask-security.

[pdonorio]

The best shot (i guess) is to generate a Token via REST API.

So maybe this question belongs to the REST-mock and all of its fork?

What do you think @mdantonio

[pdonorio]

Also to solve in the idea of our mix about accounting:

• is angular ever going to call API? in that case how can both flask and angular have access with the same user/pwd to a valid token? they will ask for two separated? Flask would save the token on server side, which is the most secure way.

This is just to clear our idea of mixing and on which operations.

[pdonorio]

Discussion:

• Angular should receive a token from Flask and safely store it in a secure cookie
• The flask login should be handled by REST API
• Our REST API base is rest-mock

So the blueprint should be handled inside the rest base project: pdonorio/rest-mock#1

[pdonorio]

Waiting for rest-mock. Then we should test this with:

• Flask token save (Database)
• Flask passes the token to Angular (don't know how)
• Angular token save and use (Secure cookie)

Also:

• Angular should watch the cookie and check the token every x minutes (one?)
• API should have a security parameter to couple Flask and Angular to the same request
• Once angular token is missing but Flask still works, API should make the token invalid