Graham McIntire
c6d2c48264
Adds bearer-token authenticated REST API at /api/v1 covering every action a non-admin user can perform on the website: contact + beacon submission, beacon-monitor management, propagation queries, profile read/update, and self-service API token issuance/revocation. Security: SHA-256-hashed bearer tokens (mwp_ prefix, plaintext shown once at creation), RFC 9457 problem+json error responses, RFC 9651 RateLimit-* headers backed by an ETS bucket (600/min per token, 60/min per anonymous IP, 30/min on /auth/tokens), private-contact filtering by viewer. Docs at docs/api/README.md (prose reference) and docs/api/openapi.yaml (OpenAPI 3.1 spec covering every endpoint, response, and schema). Tests: 124 new tests across schema, plug, error renderer, rate limiter, fallback, and every controller. 16/17 API modules at 100% line coverage; FallbackController at 87.5% (one defmodule line, an Erlang-cover artifact for action_fallback-only modules).
37 lines
897 B
Elixir
37 lines
897 B
Elixir
defmodule MicrowavepropWeb.Api.V1.UserJSON do
|
|
@moduledoc "Renders user representations for /api/v1."
|
|
|
|
alias Microwaveprop.Accounts.User
|
|
|
|
@doc "Public profile (no email)."
|
|
def public(%User{} = user) do
|
|
%{
|
|
data: %{
|
|
id: user.id,
|
|
callsign: user.callsign,
|
|
name: user.name,
|
|
home_grid: user.home_grid,
|
|
home_lat: user.home_lat,
|
|
home_lon: user.home_lon
|
|
}
|
|
}
|
|
end
|
|
|
|
@doc "Authenticated /me view (includes email + admin flag)."
|
|
def me(%User{} = user) do
|
|
%{
|
|
data: %{
|
|
id: user.id,
|
|
callsign: user.callsign,
|
|
name: user.name,
|
|
email: user.email,
|
|
is_admin: user.is_admin,
|
|
confirmed_at: user.confirmed_at,
|
|
home_grid: user.home_grid,
|
|
home_lat: user.home_lat,
|
|
home_lon: user.home_lon,
|
|
home_elevation_m: user.home_elevation_m
|
|
}
|
|
}
|
|
end
|
|
end
|