Project Vorbote | Security in Resthooks and Tests

Challenge Objectives

• Confirm the existence of the Resthook created

• Improve current tests

 

Project Background

• Project Vorbote is a nodejs and reactjs based app

• The app allows any Topcoder members to subscribe to events that occurs on the Topcoder platform

• Essentially, the app allows a member to setup their own webhooks, for example, to be notified when a contest is launched

 

Technology Stack

• Nodejs version 8

• Reactjs

• Mongodb

• Kafka

 

Code access

You can find the code here. Kindly use the develop branch for your changes.

 

Individual requirements

Confirm the existence of the resthook created (Major Requirement)

• When a user creates a Resthook, we need to confirm the existence of the Resthook.

• Enhance the Resthook model and provide an additional attribute named “confirmed” of Boolean type.

• When a Resthook is created, our app (backend) needs to send a POST request to the Resthook endpoint with an empty body and with a unique key (uuid) passed through the “x-hook-secret” header.

• The Resthook endpoint, in turn needs to respond to the POST request by sending back the value passed in the “x-hook-secret” header. The value is passed in the response body from the Resthook. Note that the resthook endpoint is provided by the user - and thus the app does not have to setup anything here.

• When the Resthook responds back with the same value, this “confirms” the Resthook

• Create a new column in the current table that displays all registered Resthooks. Name this column as “Confirmed”.

• When a new Resthook is created, the value against that Resthook will be a loading indicator. The app will ping the backend every second to check if the Resthook was confirmed. If it has, the value will be a Yes (Green colored). At the end of 10 seconds, if the Resthook remains unconfirmed, the value will be a No (red colored - even if, after 10 seconds, in the backend, the Resthook gets confirmed). Below this value, provide a reload button.

  • Clicking on the Reload button will check the status of confirmation once again with the backend

  • In other words, the app will only wait for 10 seconds (and show a loading indicator) before it declares the Resthook as unconfirmed. Subsequently, the user has to manually check with the database to get the latest status.

• If the user navigates away from the page while the status is being polled for, the polling will stop. When the user comes back to the page, you will display the status as present in the database for that Resthook (and display the reload button for Resthooks that are not yet confirmed).

• This feature is possible for both admin and non admin users

 

Provide confirmation on deletion (Minor Requirement)

• Currently, a user (including an admin) can delete the Resthooks created and in case of an admin, delete the roles and the associated topics against the roles.

• However, no confirmation is asked to the user before deletion.

• Kindly provide a modal that asks the user if they are sure that they wish to delete - in case of confirmation, proceed with the deletion.

 

Improve current tests

• The tests that exist for the backend need to be improved. Tests for frontend are not in scope.

• You need to use nock, mocha and chai for your tests

• You can add new tests and remove current tests (or even write the tests from scratch)

• You should also have a code coverage of 80% or more for the app

• The review for this section will be taken up under the dedicated section for tests in the review scorecard and not under major requirement

 

Deployment guide and validation document

We don’t expect any changes to the deployment. You don't have to provide a validation document. Reviewers will verify your submission against the above requirements.

 

Important Notes

• Follow existing conventions used in the app. Note that we are using bulma for our CSS. You are expected to use bulma's own classes instead of creating new ones that have the exact same styles.

• Ensure there are no lint errors in the app.

• Tests for the newly added features are also in scope.

• The changes that you are carrying out are only on the UI. Existing functionality should continue to work as before.

• In case you are well versed with UI but are not familiar with Kafka or Nodejs, you can still participate - use docker for kafka and simply set the configuration without going through the hassle of installing it.

Final Submission Guidelines

Submit a git patch of your changes agains the latest commit with hash 7abc9deb632fa043eae15a120190dd41b41a79d8