Skip to content

Add authentication and deck ownership #13

Description

@scar0x00

Summary

Currently, the application operates as a public utility where all flashcard decks are shared globally. Anyone with a deck's UUID can view, edit, or delete it, and the "Saved Decks" list shows all decks created by every user.

Proposed Changes

  • Database Migration: Update the D1 database schema in api/deck-store/sql_tables/deck_table.sql to include a owner_id column (TEXT).
  • Authentication Middleware: Implement Hono middleware to verify user identity.
  • Ownership Enforcement: Create: Update the PUT /deck/:deckid endpoint to store the owner_id of the authenticated user.
  • List: Update GET /decks to filter results based on the authenticated owner_id.
  • Manage: Update GET, PUT, and DELETE for specific decks to verify that the requesting user matches the owner_id stored in the database.
  • Wrap the application in an authentication provider.
  • Add Login/Logout buttons to the main navigation.
  • Protect the /decks and /generate routes, redirecting unauthenticated users to a landing or login page.
  • Update the loader in app/routes/decks.tsx and the action logic for saving decks to include the auth token in the request headers.
  • Only show "Edit" and "Delete" options for decks owned by the current user.

Acceptance Criteria

  • Users can sign up and log in.
  • Decks created while logged in are private to that user.
  • The /decks page displays only the current user's decks.
  • Attempting to access or delete someone else's deck ID returns a 403 Forbidden or 404 Not Found.
  • Authentication state persists across page refreshes.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions