cawfeecoder / barbr Goto Github PK

As a user, I should not be able to do the following:

• Delete my account
• Update my account
• Retrieve my account details
  If the following conditions are met:
• My account is in a status of "purge"
• My account is in a status of "disabled"
  Moreover, the following features hold:
• Other users can also not pull my account in their queries

As a system, I need to generate JWT for the following:

• User login event
  In particular:
• A successfully authentication event will trigger a JWT authentication to be returned via Cookies.

As a system, I do not want to expose my configuration options and secrets, such as:

• MongoDB credentials
• Argon2 parameters
• JWT secret
  This requires that:
• System contacts an external store (Hashicorp Vault) to retrieve it's secret
  This also opens the possibility:
• Certain data is encrypted before storage in MongoDB and later decrypted

As a system providing authentication, I need to:

• Handle pre-mature expiration of tokens, such as logout, suspensions, or other such events
  This requires:
• A redis store to hold a blacklist until expiration of each token

TBD

As a system, I want to be able to:

• Provide query parameters that dictate the fields that will come back
  In particular, when I execute a query that returns data:
• Query parameters will set a particular Mongo projection

As a user/application, I may want the following:

• Query multiple ids
• Support GraphQL pagination
• Provide a condition on which to restrict my query