Graham McIntire
c6d2c48264
Adds bearer-token authenticated REST API at /api/v1 covering every action a non-admin user can perform on the website: contact + beacon submission, beacon-monitor management, propagation queries, profile read/update, and self-service API token issuance/revocation. Security: SHA-256-hashed bearer tokens (mwp_ prefix, plaintext shown once at creation), RFC 9457 problem+json error responses, RFC 9651 RateLimit-* headers backed by an ETS bucket (600/min per token, 60/min per anonymous IP, 30/min on /auth/tokens), private-contact filtering by viewer. Docs at docs/api/README.md (prose reference) and docs/api/openapi.yaml (OpenAPI 3.1 spec covering every endpoint, response, and schema). Tests: 124 new tests across schema, plug, error renderer, rate limiter, fallback, and every controller. 16/17 API modules at 100% line coverage; FallbackController at 87.5% (one defmodule line, an Erlang-cover artifact for action_fallback-only modules).
102 lines
3.1 KiB
Elixir
102 lines
3.1 KiB
Elixir
defmodule MicrowavepropWeb.Api.V1.MeController do
|
|
@moduledoc """
|
|
Endpoints scoped to the authenticated user's own profile, contacts,
|
|
beacons, beacon monitors, and API tokens.
|
|
"""
|
|
|
|
use Phoenix.Controller, formats: [:json]
|
|
|
|
alias Microwaveprop.Accounts
|
|
alias Microwaveprop.BeaconMonitors
|
|
alias Microwaveprop.Beacons
|
|
alias Microwaveprop.Radio
|
|
alias MicrowavepropWeb.Api.ErrorJSON
|
|
alias MicrowavepropWeb.Api.V1.BeaconJSON
|
|
alias MicrowavepropWeb.Api.V1.BeaconMonitorJSON
|
|
alias MicrowavepropWeb.Api.V1.ContactJSON
|
|
alias MicrowavepropWeb.Api.V1.TokenJSON
|
|
alias MicrowavepropWeb.Api.V1.UserJSON
|
|
|
|
plug :accepts, ["json"]
|
|
action_fallback MicrowavepropWeb.Api.FallbackController
|
|
|
|
## Profile -----------------------------------------------------------
|
|
|
|
def show(conn, _params) do
|
|
user = conn.assigns.current_api_user
|
|
json(conn, UserJSON.me(user))
|
|
end
|
|
|
|
def update(conn, params) do
|
|
user = conn.assigns.current_api_user
|
|
attrs = Map.take(params, ["home_grid", "home_lat", "home_lon", "home_elevation_m"])
|
|
|
|
case Accounts.update_user_home_qth(user, attrs) do
|
|
{:ok, updated} -> json(conn, UserJSON.me(updated))
|
|
{:error, changeset} -> ErrorJSON.send_changeset(conn, changeset)
|
|
end
|
|
end
|
|
|
|
## My contacts -------------------------------------------------------
|
|
|
|
def contacts(conn, _params) do
|
|
user = conn.assigns.current_api_user
|
|
contacts = Radio.list_contacts_for_user(user)
|
|
json(conn, ContactJSON.index(%{contacts: contacts, viewer: user}))
|
|
end
|
|
|
|
## My beacons --------------------------------------------------------
|
|
|
|
def beacons(conn, _params) do
|
|
user = conn.assigns.current_api_user
|
|
beacons = Beacons.list_beacons_for_user(user)
|
|
json(conn, BeaconJSON.index(%{beacons: beacons}))
|
|
end
|
|
|
|
## API tokens --------------------------------------------------------
|
|
|
|
def list_tokens(conn, _params) do
|
|
user = conn.assigns.current_api_user
|
|
tokens = Accounts.list_api_tokens(user)
|
|
json(conn, TokenJSON.index(%{tokens: tokens}))
|
|
end
|
|
|
|
def revoke_token(conn, %{"id" => id}) do
|
|
user = conn.assigns.current_api_user
|
|
|
|
with {:ok, token} <- Accounts.revoke_api_token(user, id) do
|
|
json(conn, TokenJSON.show(%{token: token}))
|
|
end
|
|
end
|
|
|
|
## Beacon monitors ---------------------------------------------------
|
|
|
|
def list_monitors(conn, _params) do
|
|
user = conn.assigns.current_api_user
|
|
monitors = BeaconMonitors.list_monitors_for_user(user)
|
|
json(conn, BeaconMonitorJSON.index(%{monitors: monitors}))
|
|
end
|
|
|
|
def create_monitor(conn, params) do
|
|
user = conn.assigns.current_api_user
|
|
attrs = Map.take(params, ["name"])
|
|
|
|
case BeaconMonitors.create_monitor(user, attrs) do
|
|
{:ok, monitor} ->
|
|
conn
|
|
|> put_status(:created)
|
|
|> json(BeaconMonitorJSON.show(%{monitor: monitor}))
|
|
|
|
{:error, changeset} ->
|
|
ErrorJSON.send_changeset(conn, changeset)
|
|
end
|
|
end
|
|
|
|
def delete_monitor(conn, %{"id" => id}) do
|
|
user = conn.assigns.current_api_user
|
|
|
|
with {:ok, _monitor} <- BeaconMonitors.delete_monitor(user, id) do
|
|
send_resp(conn, 204, "")
|
|
end
|
|
end
|
|
end
|