rendall / simple-comment Goto Github PK

Currently there are no frontend tests, so altering or creating new functionality is a crapshoot. Add cypress to the testing suite to drive TDD for frontend

Right now if there is a comment by a user, the administrator does not receive a notification.

The administrator should receive a notification.

https://simple-comment.netlify.app errors with the following:

{
  "errorType": "Error",
  "errorMessage": "package.json does not exist at /package.json",
  "trace": [
    "Error: package.json does not exist at /package.json",
    " at Object.t.find (/var/task/src/verify.js:3:443031)",
    " at Object. (/var/task/src/verify.js:135:333456)",
    " at Object. (/var/task/src/verify.js:135:336547)",
    " at r (/var/task/src/verify.js:1:158)",
    " at Object. (/var/task/src/verify.js:135:333068)",
    " at r (/var/task/src/verify.js:1:158)",
    " at Object. (/var/task/src/verify.js:135:78445)",
    " at r (/var/task/src/verify.js:1:158)",
    " at Object. (/var/task/src/verify.js:245:253032)",
    " at r (/var/task/src/verify.js:1:158)"
  ]
}

README instructions Upload the login.html page on the root of your website (or somewhere accessible). login.html exists nowhere. Either include login.html or remove the instruction.

Currently the auth cookie has no expiration, which means that guest users authentication ends at the end of the session.

Currently each sub-project shares the same, project root directory for tsconfig and webpack. This creates conflicts.

For instance, vscode uses tsconfig.json to understand TypeScript highlighting, but Svelte and vanilla js and netlify.functions each use their own config file. This requires quite a bit of fiddling to get each to behave well during writing and building.

Break each project into its own sub directory, something roughly like:

├── svelte/
│   ├── tsconfig.json
│   ├── webpack.ts
│   ├── src/
│   ├──── main.ts
│   ├──── ...
├── shared/
│   ├── tsconfig.json
│   ├── webpack.ts
├── netlify.functions/
│   ├── tsconfig.json
│   ├── webpack.ts
├── project.json

README instruction For IS_CROSS_SITE add the value production is confusing, as IS_ implies boolean. This should be changed to values true or false or the name should change to CROSS_SITE_MODE

Rambling. Let's make it easier to read and recommend.

ALLOW_ORIGIN in .env is confusing and needs fixes.

1. Currently, policy.refererRestrictions set to false completely bypasses this check.
   • Enable wildcards in the ALLOW_ORIGIN value, so a value of https://o.net/blog/* would allow any page, e.g. ../blog/topic.html
   • Remove the policy flag entirely, and a simple * glob value would be effectively the same.
2. ALLOW_ORIGIN is not intuitive.
   • It can hold multiple origins as a value, maybe ALLOW_ORIGINS, plural?
   • ORIGIN is not immediately clear. Maybe URL? Or something more intuitive?
   • ALLOW_something implies a boolean. Perhaps ALLOWED...?

Two issues, here:

1. The Cookie and the JWT expirations should correspond, but right now the Cookie expires in over 1000 years, and the JWT expires in 24 hours
2. When the JWT is expired, the /user endpoint fails with a "User not authenticated" error.

• The endpoint should issue a more detailed "User authentication expired" error message
• The frontend should redirect to login

Create a page that will show all comments across the simple-comment instance.

For now, no pagination, but this will be necessary in future.

./verify endpoint returns a 401 error without a WWW-Authenticate header

A server generating a 401 (Unauthorized) response MUST send a WWW-Authenticate header field containing at least one challenge.

per https://tools.ietf.org/html/rfc7235#section-4.1

Currently the guest user does not have access to the log in button, since it is hidden for all logged-in users, including guests.

Guest users should be able to log in.

Currently the frontend client is a series of document.append calls. Update the client with a modern framework.

Two issues:

1. When guest user submits comment, the new validation rule applies to password. Guest user will never be able to submit a comment, because guest users do not have passwords
2. This fails silently with no notification

The png logo should have a transparent background with a drop-shadow or stroked outline. This will let it show up clearly no matter the background color.

https://simple-comment.netlify.app/img/twitter-card-logo.png

https://simple-comment.netlify.app displays a "Topic 'https---simple-comment-netlify-app-' not found" error

When a new page is created, Simple Comment is supposed to allow the first visitor to create a topic if it follows a specific format. However, it fails with "unknown referer".

This requires a work-around of the admin creating these topics by hand in the database.

Currently the linter is no-async-promise-executor: "warn". Let's change that to "error" and update code where it happens.