Description

The frontend fetches data to validate that UI elements can be shown (i.e. authentication checks) and to display file listings (i.e. viewing files owned). There is not loading state associated with "data is loading", leading to blank screens and uncomfortable layout shifts and flickering.

Because of how @tanstack/react-query works, the isLoading / isPending state would be leveraged to display loading states that would hide half-baked UI.

Description

At time of writing, a user can log in via /login, but there's no UI-driven flow to sign off. The JWT generated on sign-in will expire after 10 minutes, forcing a log-off, but that's not sufficient (especially since JWTs should be refreshable - out of scope here).

A user should be able to navigate to /logout to terminate their session and invalidate their credentials.

Before being ready for a first release, Rotini should have a User/Authorization/Ownership flow so that uploaded files are accessible only by their owner.

Description

Because of the way the file destination path is built, uploading a file twice will lead to two items in the UI and in the database, but a single item on disk. This is because uploaded files are not prefixed in any way.

Users should be able to upload a file more than once without colliding and file duplicates should be distinct on disk.

Right now, migration validation happens implicitly through the test database setup. It's probably a good idea to have a dedicate check for:

• Migration history being linear;
• Migrations being applicable from scratch.

Problem

Builds that should leverage the build dependency cache seem to miss instead [1], making builds much longer than they should be. Since the misses happen at all levels where we expect dependencies to be present, the pipeline is minutes longer than it should be.

Definition of done

• CI steps that look into the dependency cache should hit once the pipeline "Setup" step ran.

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• chore(deps): update dependency django to v4.2.13
• chore(deps): update dependency typescript to v5.4.5
• chore(deps): update dependency vite to v5.2.12
• chore(deps): update testing-library monorepo (@testing-library/jest-dom, @testing-library/react)
• fix(deps): update material-ui monorepo to v5.15.19 (@mui/icons-material, @mui/material)
• chore(deps): update dependency @biomejs/biome to v1.7.3
• chore(deps): update dependency @vitejs/plugin-legacy to v5.4.0
• chore(deps): update dependency jsdom to v24.1.0
• chore(deps): update dependency vitest to v1.6.0
• chore(deps): update dependency watchfiles to v0.22.0
• chore(deps): update react monorepo (@types/react, @types/react-dom, react, react-dom)
• chore(deps): update yarn to v4.2.2
• fix(deps): update dependency axios to v1.7.2
• chore(deps): update testing-library monorepo (major) (@testing-library/dom, @testing-library/react)
• 🔐 Create all rate-limited PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update dependency idna to v3.7 [security]
• chore(deps): update dependency sqlparse to v0.5.0 [security]
• chore(deps): update dependency python-multipart to v0.0.9
• chore(deps): update dependency sniffio to v1.3.1
• chore(deps): update dependency @types/node to v20.12.13
• chore(deps): update dependency anyio to v4.4.0
• chore(deps): update dependency asgiref to v3.8.1
• chore(deps): update dependency djangorestframework to v3.15.1
• chore(deps): update dependency terser to v5.31.0
• chore(deps): update dependency uvicorn to v0.30.0
• fix(deps): update dependency @tanstack/react-query to v5.40.0
• chore(deps): update dependency pytz to v2024
• Click on this checkbox to rebase all open PRs at once

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• chore(deps): update dependency django to v5

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

Description

Currently, the application uses a JWT stored in a cookie to authenticate queries against the backend. The application itself isn't looking at the token nor does it know its contents, so it's never actually aware of whether a user is logged in or not.

Awareness of "logged in" can be useful to gate certain features (i.e. navigation button that aren't available when not logged in) and to gracefully handle cases such as "user is already logged out, attempts to log out again".

Design

Having a hook, something like useCurrentUser, that would fetch data from the API about the logged in user to verify whether the user is logged in and who they are would be useful.

Description

Sessions are currently limited in time by the JWT expiration time. Once they expire, further attempts to interact with the API will kick the user off because of expired credentials.

The application should allow refreshing the token to avoid having to re-log in.

Further reading

👁️ What Are Refresh Tokens and How to Use Them Securely