2017-02-28 17:29:28 +08:00
|
|
|
|
|
|
|
|
# Chronos
|
|
|
|
|
|
2017-02-28 17:02:53 +08:00
|
|
|
A school event planner and timetable
|
2017-02-28 17:29:28 +08:00
|
|
|
|
|
|
|
|
## Todo
|
|
|
|
|
|
|
|
|
|
- [ ] Migrations, default data
|
|
|
|
|
- [ ] Authentication
|
2017-03-31 16:13:38 +08:00
|
|
|
- [ ] Global React `user`
|
|
|
|
|
- [x] OID auth client
|
|
|
|
|
- [ ] jwt token provider
|
|
|
|
|
- [ ] auth is a choice between oidc and pass, sends token/pass to `/auth` for validation
|
|
|
|
|
- [ ] `/auth` verifies oid token or pass, generates signed jwt
|
|
|
|
|
- [ ] jwt taken contains user role
|
|
|
|
|
- [ ] hide/protect certain element
|
|
|
|
|
- [ ] fake validator for jwt at protected endpoints
|
|
|
|
|
- [ ] assume user is admin
|
2017-02-28 17:29:28 +08:00
|
|
|
- [ ] Create group
|
|
|
|
|
- [ ] Create one-off events
|
|
|
|
|
- [ ] Create attachments
|
|
|
|
|
- [ ] Description
|
|
|
|
|
- [ ] File
|
|
|
|
|
- [ ] Create group CCAs
|
|
|
|
|
- [ ] Create group mentor
|
|
|
|
|
- [ ] Display events as agenda
|
|
|
|
|
- [ ] Display events as calendar
|
|
|
|
|
|
|
|
|
|
- [ ] Create sample data
|
2017-04-06 21:20:23 +08:00
|
|
|
|
|
|
|
|
## Security Pitfalls
|
|
|
|
|
|
|
|
|
|
- Auth mechanism not verified
|
2017-04-12 00:14:51 +08:00
|
|
|
- Verification of OID tokens is done by upn being the email address
|
2017-04-06 21:20:23 +08:00
|
|
|
- Succeptable to insecure direct object references
|
