manimozaffar / fast-auth Goto Github PK

• Cache wrong login attempts
• Black list brute force attacker after X logins, fooling him by showing always "pw is wrong"
• Send email to user regarding brute force attacks
• Don't spam user, only send email once 12h (use redis). Only email if attacker is using more than 5 different IPs.

• Verify email address with JWT
• Use different secret key than the real one used for auth
• Tests

I copied this code from my source project, where there's only very few active users, but the sensitivity was high so I was actually storing the "refresh token" itself as well,
now this is general boilerplate, no business logic, then in general we shouldn't save refresh token, no point to.
Just blacklist if needed!

so that functionality must be developed

• Email field must be added
• Alembic migration must fixed
• Refactor old test

• Leverage the OAuth proto to write endpoints for apple/gmail and sync with their OAuth
• Write tests

• Write proto and base class for OAuth2 integration, and add it to endpoint.
• Write tests

• Change username/email/password endpoints
• Secure with 2FA
• setup 2FA when registrating user
• Change DB schema
• Alembic update
• Tests

• Setup Opentelemetry to send logs to main service if needed, make it optional

Roadmap for developing boilerplate:

• Add email field
• Mail client
• Email and verify email address on registration endpoint
• Alarm unauthorized logins with mailing
• Change username/email/password functionality with 2FA step (as email/gauth)
• Opentelemetry integration
• OAuth2 proto integration
• OAuth support for gmail and apple

Roadmap for testıngs:

• Json data containing few user to be used in tests/dev stage to be injected to db directly
• Mocking email client
• Tests for all new features added

• Mail client base class
• add new variable to .ENV
• Mail client mock
• tests

• Write github action to run tests and lint.