Summary
Currently, the application operates as a public utility where all flashcard decks are shared globally. Anyone with a deck's UUID can view, edit, or delete it, and the "Saved Decks" list shows all decks created by every user.
Proposed Changes
- Database Migration: Update the D1 database schema in api/deck-store/sql_tables/deck_table.sql to include a owner_id column (TEXT).
- Authentication Middleware: Implement Hono middleware to verify user identity.
- Ownership Enforcement: Create: Update the PUT /deck/:deckid endpoint to store the owner_id of the authenticated user.
- List: Update GET /decks to filter results based on the authenticated owner_id.
- Manage: Update GET, PUT, and DELETE for specific decks to verify that the requesting user matches the owner_id stored in the database.
- Wrap the application in an authentication provider.
- Add Login/Logout buttons to the main navigation.
- Protect the /decks and /generate routes, redirecting unauthenticated users to a landing or login page.
- Update the loader in app/routes/decks.tsx and the action logic for saving decks to include the auth token in the request headers.
- Only show "Edit" and "Delete" options for decks owned by the current user.
Acceptance Criteria
- Users can sign up and log in.
- Decks created while logged in are private to that user.
- The /decks page displays only the current user's decks.
- Attempting to access or delete someone else's deck ID returns a 403 Forbidden or 404 Not Found.
- Authentication state persists across page refreshes.
Summary
Currently, the application operates as a public utility where all flashcard decks are shared globally. Anyone with a deck's UUID can view, edit, or delete it, and the "Saved Decks" list shows all decks created by every user.
Proposed Changes
Acceptance Criteria