{"push_id":2743547569,"size":19,"distinct_size":19,"ref":"refs/heads/master","head":"b5c3a0ba8123e0516dd09e1ca66e945c413db240","before":"074dc5f5133ceba22ac12d8cc80e4e3f716b1a87","commits":[{"sha":"0c61b9586c24951b03b32ee693fcbf4628b0dfe9","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Specify the response to a request for all Observations\n\nWhen an HTTP client sends a GET request to the path '/api/v1/observations', the server's response should have JSON in the body which contains all of the Observations in the database. Each Observation in the JSON should have the following fields:\n  id\n  species_id\n  latitude\n  longitude\n  date","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/0c61b9586c24951b03b32ee693fcbf4628b0dfe9"},{"sha":"e48a120e8f9a2fccfc75cd7b36116fadd20ef4b1","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Implement responding to a request for all Observations\n\nWhen an HTTP client sends a GET request to the path '/api/v1/observations', the server's response has JSON in the body which contains all of the Observations in the database. Each Observation in the JSON has the following fields:\n  id\n  species_id\n  latitude\n  longitude\n  date","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/e48a120e8f9a2fccfc75cd7b36116fadd20ef4b1"},{"sha":"431b2fe116b1c11553133efe487606dba805b4e5","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Specify the response to a request for a single Observation\n\nWhen an HTTP client sends a GET request to the path '/api/v1/observations/:id', where :id is the primary key of an Observation record, the server's response should have JSON in the body which contains that particular Observation record. The Observation in the JSON should have the following fields:\n  id\n  species_id\n  latitude\n  longitude\n  date","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/431b2fe116b1c11553133efe487606dba805b4e5"},{"sha":"bb3e89d2ac0e9f09f77ecc1d68d6fdb4cd88426d","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Implement responding to a request for a single Observation\n\nWhen an HTTP client sends a GET request to the path '/api/v1/observations/:id', where :id is the primary key of an Observation record, the server's response has JSON in the body which contains that particular Observation record. The Observation in the JSON has the following fields:\n  id\n  species_id\n  latitude\n  longitude\n  date","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/bb3e89d2ac0e9f09f77ecc1d68d6fdb4cd88426d"},{"sha":"a6581239fe813b5d99dbb433ff7836661897a06a","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Specify creating a new Observation record\n\nWhen an HTTP client sends a POST request to the path:\n\n/api/v1/observations?observation[latitude]=<latitude>&observation[longitude]=<longitude>&observation[date]=<date>&observation[species_id]=<species_id>\n\nwith valid values substituted for <latitude>, <longitude>, <date>, and <species_id>,\n\nthe server should create a new Observation record in the database and send a 200 OK response.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/a6581239fe813b5d99dbb433ff7836661897a06a"},{"sha":"363bae633691d6df5eeb7add2ff78a60dc699a87","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Implement creating a new Observation record\n\nWhen an HTTP client sends a POST request to the path:\n\n/api/v1/observations?observation[latitude]=<latitude>&observation[longitude]=<longitude>&observation[date]=<date>&observation[species_id]=<species_id>\n\nwith valid values substituted for <latitude>, <longitude>, <date>, and <species_id>,\n\nthe server creates a new Observation record in the database and sends a 200 OK response.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/363bae633691d6df5eeb7add2ff78a60dc699a87"},{"sha":"cdb1f7308589bfa237767f4a85e1a55617aad8a7","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Specify responding to an invalid POST request\n\nWhen an HTTP client sends a POST request with query parameters that cannot be used to create a valid Observation record, the server should not create a new Observation record in the database and should send a 400 Bad Request response.\n\nThis commit also changes the RSpec matchers in the rest of the request specs to explicitly expect a 200 or 400 response code. This allows more distinct differentiation between different HTTP responses versus the previous usage of the RSpec be_success matcher.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/cdb1f7308589bfa237767f4a85e1a55617aad8a7"},{"sha":"75e503d2af89363bac1d6400f89108977ce7cf7e","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Implement responding to an invalid POST request\n\nWhen an HTTP client sends a POST request with query parameters that cannot be used to create a valid Observation record, the server does not create a new Observation record in the database and sends a 400 Bad Request response.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/75e503d2af89363bac1d6400f89108977ce7cf7e"},{"sha":"1a337662c53413cd64816ed154662e56870920e4","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Improve readability of a spec's request parameters\n\nThis commit changes the POST request in the Observation request specification for better readability.\n\nPreviously, the query parameters of the POST requests were hard-coded into a complete query string, which was long and difficult to read. The query parameters are now set using the params: {} option of the ActionDispatch::Integration::Session object as described here: http://api.rubyonrails.org/classes/ActionDispatch/Integration/Session.html#method-i-process. This makes the structure of the query parameters more visually clear.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/1a337662c53413cd64816ed154662e56870920e4"},{"sha":"07819b88fa7bdaed3c13db388571841de4aaef2a","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Specify authorization in HTTP requests\n\nAn HTTP request should respond to any unauthorized request with a 400 and a blank response body.\n\nIn order for a request to be considered authorized, the request should have an Authorization header with the value 'Bearer <AUTH_TOKEN>', where <AUTH_TOKEN> matches an authorization token that is saved as an environment variable.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/07819b88fa7bdaed3c13db388571841de4aaef2a"},{"sha":"41027510aecf4a1bfeb1aa89b47b74b1d150b82f","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Implement authorization in HTTP requests\n\nAn HTTP request responds to any unauthorized request with a 400 and a blank response body.\n\nIn order for a request to be considered authorized, the request must have an Authorization header with the value 'Bearer <AUTH_TOKEN>', where <AUTH_TOKEN> matches an authorization token that is saved as an environment variable.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/41027510aecf4a1bfeb1aa89b47b74b1d150b82f"},{"sha":"e710fdceceedea74c0ffcac36302b003858bbe17","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Add a test case for a missing authorization header\n\nUnder the current implementation, a request with no authorization header at all would still be considered authorized. This commit adds a specification that a request with no authorization header should be considered unauthorized and should result in a 400 response.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/e710fdceceedea74c0ffcac36302b003858bbe17"},{"sha":"f82c4ac43dcbe320ecc4b1186119f49fa47cf696","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Cover the case of a missing authorization header\n\nIf the request has no authorization header, the request is considered unauthorized and results in a 400 response.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/f82c4ac43dcbe320ecc4b1186119f49fa47cf696"},{"sha":"007b65f54fc786fde20e1b8142f91a2472f64536","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Add more test cases\n\nThis commit specifies that a request with an authorization header containing the correct authorization token but otherwise improperly structured should result in a 400 response. In this case, the improper structure involves a typo in the 'Bearer' component of the authorization header's value.\n\nThis commit also adds all of the test cases to the POST request section that previously were only tested for GET requests. Specifically, POST and GET requests are now tested for:\n  - an authorization header that is properly structured but has the wrong authorization token\n  - an authorization header that has the correct authorization token but is improperly structured\n  - no authorization header\n\nAll of these cases are already green under the current implementation.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/007b65f54fc786fde20e1b8142f91a2472f64536"},{"sha":"c55e9531bace401e23133a1f470130a600fa932a","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Eliminate some repetition in the request specs\n\nThis commit makes the specs slightly less verbose by moving a repeated line of setup code into a single line of code in a setup block.\n\nMore specifically, the authorization token was previously set as an environment variable in each test case individually, and is now set in a block that runs before each test case.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/c55e9531bace401e23133a1f470130a600fa932a"},{"sha":"537011b5400555bff4148b4a63a809984a0f25d5","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Handle request authentication in a distinct controller\n\nThis commit improves adherence to single-responsibility architecture by moving the HTTP request authentication process out of the Observations controller and into a new Authentication controller. With these changes, the Authentication controller acts as a filter that only lets authenticated requests through, and the Observations controller only handles requests regarding Observations.\n\nThe Observations controller inherits from the Authentication controller, which inherits from the Application controller.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/537011b5400555bff4148b4a63a809984a0f25d5"},{"sha":"dd97c8aa1829eff2484f61bb67be8e93cac56268","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Extract authentication logic out of controller\n\nThis commit improves adherence to single-responsibility architecture by extracting the authentication logic into a new Authentication module, leaving the Authentication controller to only handle filtering out unauthenticated HTTP requests.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/dd97c8aa1829eff2484f61bb67be8e93cac56268"},{"sha":"13347de79149043a8c84dd3460623cc49b60c8f1","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Specify secure authentication\n\nThis commit specifies defending the client/server authentication process from HTTP eavesdropping and replay attacks.\n\nTo authenticate, the client should:\n - generate a random nonce (number used only once)\n - concatenate the nonce to the end of the authorization token\n - hash the resulting string using SHA256\n - set the resulting token digest in an Authorization header in the HTTP request as follows:\n    'Authorization': 'Bearer <token digest>'\n - set the nonce as the value of a Nonce header in the HTTP request as follows:\n    'Nonce': '<nonce>'\n\n When the server receives a request, the server should:\n  - concatenate the nonce supplied in the HTTP request to end of the actual authorization token\n  - generate a server token digest by hashing the resulting string using SHA256\n  - compare the resulting server token digest to the bearer token digest\n  - conclude that the client is authorized if and only if the server token digest matches the client's bearer token digest\n\nThe usage of one-way hashing via SHA256 prevents an eavesdropper from deciphering the original authorization token. The usage of a nonce defends against replay attacks by ensuring a different bearer token digest for each request, despite using the same authorization token every time.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/13347de79149043a8c84dd3460623cc49b60c8f1"},{"sha":"b5c3a0ba8123e0516dd09e1ca66e945c413db240","author":{"name":"edwardsCNC","email":"5ff30fa979d26eed9101018793fa726ba4d79e0f@gmail.com"},"message":"Implement secure authentication\n\nThis commit implements defending the client/server authentication process from HTTP eavesdropping and replay attacks.\n\nTo authenticate, the client should:\n - generate a random nonce (number used only once)\n - concatenate the nonce to the end of the authorization token\n - hash the resulting string using SHA256\n - set the resulting token digest in an Authorization header in the HTTP request as follows:\n    'Authorization': 'Bearer <token digest>'\n - set the nonce as the value of a Nonce header in the HTTP request as follows:\n    'Nonce': '<nonce>'\n\n When the server receives a request, the server:\n  - concatenates the nonce supplied in the HTTP request to end of the actual authorization token\n  - generates a server token digest by hashing the resulting string using SHA256\n  - compares the resulting server token digest to the bearer token digest\n  - concludes that the client is authorized if and only if the server token digest matches the client's bearer token digest\n\nThe usage of one-way hashing via SHA256 prevents an eavesdropper from deciphering the original authorization token. The usage of a nonce defends against replay attacks by ensuring a different bearer token digest for each request, despite using the same authorization token every time.","distinct":true,"url":"https://api.github.com/repos/nickedwards109/ecological-observation-server/commits/b5c3a0ba8123e0516dd09e1ca66e945c413db240"}]}
{"actor":{"display_login":"nickedwards109"}}