jacob/munch-ease-backend
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(meals+auth): remove Person from meals v2 DTOs (MemberRef) and adopt Argon2 hashing

Browse source
This commit is contained in:
jableader 2025-11-01 17:00:36 +11:00
parent 8fd780ee17
commit d093d1567e
3 changed files with 54 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
backend-spec.md
View file

@ -280,14 +280,16 @@ Impact on existing routes (exact files to refactor):
Status summary: Status summary:
- Implemented: JWT auth v2 with refresh cookie; household domains and membership; invitations; full household scoping across recipes/meals/shopping; OpenAPI augmentation with bearerAuth and 403; RFC7807 preserved; tests green. - Implemented: JWT auth v2 with refresh cookie; household domains and membership; invitations; full household scoping across recipes/meals/shopping; OpenAPI augmentation with bearerAuth and 403; RFC7807 preserved; tests green.
- Preserved from v1: camelCase response models, `Page<T>` pagination and cursor semantics, `Location` headers on create, shopping storeName normalization ("home"). - DTO alignment: Meals v2 now uses MemberRef { id, displayName } for chefs/cleanup/consumers (no Person in outward schema). Tests updated accordingly.
- Security: Password hashing now prefers Argon2 for new accounts with PBKDF2 verification fallback.
- Preserved: camelCase responses, `Page<T>` semantics, `Location` headers on create, shopping storeName normalization ("home").
Remaining work (post-v2 cleanup): Remaining work (prioritized cleanup):
- Remove `persons/` package and any residual references; consolidate entirely on `users`. 1. Remove `persons/` package and any residual references; consolidate entirely on `users` / `household_members`. Keep internal mapping until repositories updated.
- Optional: migrate PBKDF2 to argon2/bcrypt and add password rehash-on-login. 2. Recipes outward fields: migrate `createdBy`/`hiddenBy` to a user/member DTO (no Person) similar to meals MemberRef.
- Invitations: integrate email delivery provider and track send status. 3. Finalize v1→v2 switchover: delete v1 routers (`api/auth.py`, `api/persons.py`, `api/recipes.py`, `api/meals.py`, `api/shopping.py`) and rename `*_v2.py` to canonical names. Extract shared DTOs/helpers (currently imported from `api.shopping`) into the canonical module to avoid cross-file dependencies.
- DB: Add composite indices like `(household_id, id)` for common pagination; evaluate adding FK constraints from tenant tables to `households(id)` where safe. 4. Invitations: integrate email delivery provider and track send status.
- Rename `*_v2.py` modules back to canonical names once v1 has been fully retired (routers already removed) to reduce duplication noise. 5. DB: Add composite indices like `(household_id, id)` for pagination; evaluate additional FKs to `Household(id)`.
--- ---

44
frontend-spec.md Normal file
View file

@ -0,0 +1,44 @@
# Frontend Integration Spec (Household v2)
Date: 2025-11-01
This document summarizes the current backend API surface (post v2 migration) and the prioritized actions to keep the frontend aligned.
## Current API Highlights
- Auth: JWT bearer via `/api/v1/auth/register|login|refresh|logout`; refresh via HttpOnly cookie.
- Households: create households and list memberships.
- Household-scoped resources under `/api/v1/households/{householdSlug}`:
- Recipes: list/get/create/delete (soft-hide); list supports `q`, `cursor`, `limit`.
- Meals: upcoming/get/create/update/delete; mark consumed.
- Shopping: current aggregate; list-by-id; purchase; request/unrequest meal.
- RFC7807 Problem Details standardized for errors.
- OpenAPI includes bearerAuth and 403 for protected household routes.
## DTO alignment
- Meals v2 participants (chefs, cleanup, consumers) now use MemberRef:
- `{ id: number, displayName: string }`
- Returned in MealOut; sent in MealIn. No legacy `Person` in outward schema.
- Recipes v2 outward DTO currently omits `createdBy` in v2 list/create responses; if exposed later, it will use a user/member shape (no Person).
## Breaking changes to watch for
- Person removed from meals outward schema; use MemberRef.displayName instead of `name`.
- Household slug is required in all v2 data routes.
## Prioritized Actions (Frontend)
1) Replace any usage of Person in meals UI/state with MemberRef { id, displayName }.
2) Verify create/update meal payloads send participants in the new format (displayName).
3) Ensure auth flow relies on JWT bearer and refresh cookie; remove legacy cookie logic if still present.
4) Align OpenAPI client generation with the updated schema (regenerate clients).
## Upcoming backend cleanups (FYI)
- Remove v1 routers; rename `*_v2.py` to canonical; drop `persons/` package.
- Expose user/member DTO for recipe authorship if needed.
- Add invitation email delivery.
- DB indices/FKs polish.