raduschirliu / job-hunter-ats Goto Github PK

The CPSC 471 final project report needs to be completed, as per the project specification on D2L

Link to doc: https://docs.google.com/document/d/1Rahfj3cAc83jJNBy9v6Txpk03B2303YQfGyED1mRaN4/edit

Essentially, we need to write pseudocode for every function in every controller in https://app.diagrams.net/#G1gY_53f1fUvnGk32P9FuC2FFoSNygozVp
(this is also located in our Google Drive folder under Documents > Diagrams

Link to diagram: https://app.diagrams.net/#G1gY_53f1fUvnGk32P9FuC2FFoSNygozVp

Revoke bearer token authorization for users that are deleted from the database through the DeleteUser endpoint (DELETE api/users/{username})

There is a TODO is the codebase for this: TODO: Revoke security token

This was first noted while fixing this PR: #46

Recruiters should be able to view resumes that are associated with an application that has been submitted. Right now, they cannot view any resumes.

Companies should only be able to be created by admins, but should be able to be updated by recruiters

Our JWT secret is current hard coded into our codebase. It should be stored locally and never committed to the codebase.

Right now, any registered use in any role can change the details of any user. User information should only be able to be edited by the user themselves or an admin.

Right now, we are returning full debug messages and a 500 status code when there is a internal server error, even in release builds. Generally, this should be handled more gracefully by returning a different status code and a user readable message

Weak entities include:

• Awards
• Certifications
• Education
• Experience
• Projects
• Skills

I believe the line here
https://github.com/raduschirliu/cpsc-471-project/blob/54df15c95baefc4fab9b01ae29ab3e9ada79981d/cpsc-471-project/Startup.cs#L14

should be

public const string DBLocation = "Data Source=..\\JobHunterDB.sqlite";

as it seems to go too far back by one folder when running in debug mode in VS. Not sure if this is just me or not...

Currently, we don't require uppercase letters, symbols, etc., but we should

Recruiter have to be associated with a company. There is also a foreign key from interview to recruiter

Move logic for updating entities from PUT route into a PATCH route

Do string field require a maximum length for the purpose of this project? Need to discuss with Tamer

Three related tasks:

1. For the following methods:

• PostCompany
• PutCompany
  Input a CompanyDTO instead of a company and then update the remaining methods accordingly

2. Change ForeignKey("UserId") to ForeignKey("User") in User.cs

3. Change UserId to AdminId in Company.cs and then add a migration for the change

4. Change the Display name for Last Name in User.cs to "Last Name" (it was copy pasted as "First Name" by accident)

We need to apply access control for all of the application endpoints appropriately. Right now, our application endpoints are wide open.

For example, submitted applications should only be viewable/editable by the candidate that made the application, recruiters of the company to which the application was submitted, or Admins.

Right now, the access control for our auth endpoints is (at least in theory) secure, but some of our endpoints could either be renamed or more open to accommodate different use cases