# eda-grads

> # running

Latest version **0.0.0** (published 2016-04-26) · MIT license · 0 weekly downloads

## Install

```sh
npm install eda-grads
pnpm add eda-grads
yarn add eda-grads
bun add eda-grads
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.0.0 |
| Published | 2016-04-26 |
| First published | 2016-04-26 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 25 |
| Known vulnerabilities | 0 (+5 in 3 direct dependencies) |
| Install scripts | no |
| Author | Dominic Tarr |
| Maintainers | dominictarr |

## Links

- npm: https://www.npmjs.com/package/eda-grads
- Repository: https://github.com/dominictarr/eda-grads
- Issues: https://github.com/dominictarr/eda-grads/issues
- npm.io page: https://npm.io/package/eda-grads

## Dependencies (25)

- [rc](https://npm.io/package/rc.md) ^1.1.6
- [level](https://npm.io/package/level.md) ^1.4.0
- [stack](https://npm.io/package/stack.md) ^0.1.0
- [cookie](https://npm.io/package/cookie.md) ^0.2.3
- [marked](https://npm.io/package/marked.md) ^0.3.5
- [mkdirp](https://npm.io/package/mkdirp.md) ^0.5.1
- [muxrpc](https://npm.io/package/muxrpc.md) ^6.2.2
- [is-email](https://npm.io/package/is-email.md) ^0.1.1
- [muxrpcli](https://npm.io/package/muxrpcli.md) ^1.0.5
- [multiblob](https://npm.io/package/multiblob.md) ^1.8.2
- [deep-merge](https://npm.io/package/deep-merge.md) ^1.0.0
- [observable](https://npm.io/package/observable.md) ^2.1.4
- [pull-level](https://npm.io/package/pull-level.md) ^1.4.1
- [tiny-route](https://npm.io/package/tiny-route.md) ~2.1.2
- [hyperscript](https://npm.io/package/hyperscript.md) ^1.4.7
- [json-buffer](https://npm.io/package/json-buffer.md) ^2.0.11
- [ticket-auth](https://npm.io/package/ticket-auth.md) 0.0.1
- [html-element](https://npm.io/package/html-element.md) ^1.5.0
- [level-sublevel](https://npm.io/package/level-sublevel.md) ^6.5.4
- [pull-ws-server](https://npm.io/package/pull-ws-server.md) ^1.8.0
- [reconnect-core](https://npm.io/package/reconnect-core.md) ^1.2.0
- [validate-email](https://npm.io/package/validate-email.md) ^1.0.0
- [pull-serializer](https://npm.io/package/pull-serializer.md) ^0.3.2
- [pull-json-doubleline](https://npm.io/package/pull-json-doubleline.md) ^1.1.0
- [stream-to-pull-stream](https://npm.io/package/stream-to-pull-stream.md) ^1.6.6

## Recent versions

- 0.0.0 (latest) — 2016-04-26

## README

# enspiral dev academy grads

# running

```
git clone git@github.com:enspiral-dev-academy/grads.git
cd grads
npm install
npm run build
npm start
# open localhost:8000 in your favorite browser.

```

## authorization

Authorization uses "cookies". Cookies are something delicious you eat,
so it really doesn't make any sense to call things used for authentication
"cookies", especially when those things behave a lot like a familiar ticket
and ticket stub, as is familiar to people who have ridden a bus or gone to
the movies.

first a "ticket" is created. this is a high entropy (unguessable) token.
```
node index.js auth.create <resource>
1d67c0e114b10dc9cc96ea9cd2966f76c42539db
```
in this case, `<resource>` should probably be an email address.
this token would be emailed to the user, embedded in a link back to the server.

`http://localhost:8000/redeem/1d67c0e114b10dc9cc96ea9cd2966f76c42539db`
the server creates a cookie and sends it to you in the response,
which is also a redirect to the rest of the app (though it could easily
be a redirect to edit your newly created profile)

This is exactly like tearing off the ticket and givening you back the ticket
stub when you enter the theater. Possession of the ticket stub shows you are
authorized to see the movie.

To can test this using `curl`

```

curl localhost:8000/redeem/1d67c0e114b10dc9cc96ea9cd2966f76c42539db -c jar -b jar -v
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8000 (#0)
> GET /redeem/1d67c0e114b10dc9cc96ea9cd2966f76c42539db HTTP/1.1
> Host: localhost:8000
> User-Agent: curl/7.43.0
> Accept: */*
> 
< HTTP/1.1 200 OK
* Replaced cookie cookie="437734b0886caf51a8961b1033abb392b07333c1" for domain localhost, path /, expire 1491397335
< Set-Cookie: cookie=437734b0886caf51a8961b1033abb392b07333c1;Path=/;Expires=Wed Apr 05 2017 13:02:15 GMT+1200 (NZST)FirstPartyOnly;HttpOnly;
< Location: /
< Date: Tue, 05 Apr 2016 01:02:15 GMT
< Connection: keep-alive
< Content-Length: 0
< 
* Connection #0 to host localhost left intact
```

note that `curl` can be quite finnecky about using cookies
and to both write and read cookies you need to use `-c jar -b jar`
arguments where `jar` is the "cookie jar"

## Notes

a grad has the following data

- links to profiles (github, linkedin, twitter, etc)
- photo
- profile

# blobs

upload a photo, or CV, sets on profile. 

# updates

just merge updates to the same key?
each edit is it's own log record,
and then the document is just a view on that.

# auth

simplest is to filter out updates before they go in.
but if you ever needed multimaster you'd store the auth in the database,
then you'd need signatures.

email someone a URL with a token in it, this adds a cookie
which is authorized, and that url is now disabled.

now, that cookie has those permissions, to log in again,
resend the email.

---

permissions are: if you are authorized as the owner of an email
then you can update the record where you are marked as the owner.
else

# upload

use XHR post so we can upload files directly without
dealing with multipart.

map arguments to query string and command name to path.
sync, async, and source should all use GET. sink can use POST.


---



## License

MIT

---
_Source: https://npm.io/package/eda-grads · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._