Skip to content

Commit 5b634f8

Browse files
ashitaprasadashitaprasad
authored
Merge pull request #642 from StormGear/add-feat-insomia
Initial GSoC Application Draft
2 parents 08040d2 + 812b580 commit 5b634f8

File tree

2 files changed

+322
-0
lines changed

2 files changed

+322
-0
lines changed

‎doc/proposals/2025/gsoc/application_papa_kofi_api_auth.md‎

Lines changed: 322 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,322 @@
1+
2+
### About
3+
4+
1. Full Name
5+
- Papa Kofi Boahen
6+
3. Contact info (email, phone, etc.)
7+
- Email: [email protected]
8+
- Phone: +233538966851
9+
6. Discord handle
10+
- .papakofi
11+
7. Home page (if any)
12+
- [Link to homepage](https://devportfolio-sepia-eight.vercel.app/)
13+
9. GitHub profile link
14+
- [GitHub Profile](https://github.com/StormGear)
15+
10. Twitter, LinkedIn, other socials
16+
- [X](https://x.com/kofiishere)
17+
- [LinkedIn](https://www.linkedin.com/in/papakofiboahen)
18+
- [DevPost](https://devpost.com/papakofiboahen)
19+
11. Time zone
20+
- GMT+0 Abidjan/Accra
21+
12. Link to a resume (PDF, publicly accessible via link and not behind any login-wall)
22+
- [Link to Resume](https://drive.google.com/drive/folders/1C3aLqlWrBX4TVh9E3YesPQuqb_aE5lw6?usp=sharing)
23+
24+
### University Info
25+
26+
1. University name
27+
- Academic City University - [School Website](https://acity.edu.gh/)
28+
2. Program you are enrolled in (Degree & Major/Minor)
29+
- BSc Computer Engineering Minor: Telecommunications
30+
3. Year
31+
- 2022
32+
5. Expected graduation date
33+
- June 2025
34+
35+
### Motivation & Past Experience
36+
37+
Short answers to the following questions (Add relevant links wherever you can):
38+
1. Have you worked on or contributed to a FOSS project before? Can you attach repo links or relevant PRs?
39+
- I have been gradually learning and introducing myself to open source software development.
40+
- I have started out contributing to the APIDash project which I found quite interesting due to the fact that is was been written in Dart.
41+
- Currently, I have been able to get two PRs merged. One of the PRs was a contribution to the documentation on the installation steps for macOS users. Here is a link to the merged [PR](https://github.com/foss42/apidash/pull/521)
42+
- The other was a contribution towards adding insomnia importer to the APIDash project. This contribution led to the closing of a **High priority** issue of the repo. Here is a link to the merged [PR](xhttps://github.com/foss42/apidash/pull/525)
43+
##### Other ways I have contributed to the Open Source Community
44+
- As the Google for Developers on Campus Club Lead, I held two events introducing students to open source software. The first event which I led myself, teaching students basic Git and GitHub concepts. The second “Introduction to Open Source” event, I partnered with other universities within my country where we invited professional software engineers and open source maintainers to speak on open source development.
45+
- I have given technical talks within the developer community. Notable amongst these is my talk at the Google DevFest, Accra and Google I/O Extended events. At DevFest, I gave a talk on how to automate mobile app deployments to App Stores. Here is a link to the [Youtube Live](https://www.youtube.com/watch?v=DDFoWo0YO-k&t=6332s) event.
46+
47+
2. What is your one project/achievement that you are most proud of? Why?
48+
- In my country alone, 12,710 tons of municipal solid waste is generated daily, however only about 10% of this is collected and disposed of properly. We have set out to build a digital platform that enables users to order for and schedule trash takeouts seamlessly. We are still in the prototyping phase and are working hard to build and to acquire investor support. My role includes developing mobile applications and occasionally working on the backend. I also have business and entrepreneurship roles. We have participated in entrepreneurship training and have been able to secure some funding to kickstart the project. The app is currently released on PlayStore and AppStore would be launched to end users soon. This has potential to address a pressing challenge within my country and beyond.
49+
50+
3. What kind of problems or challenges motivate you the most to solve them?
51+
- Socio-Economic challenges motivate me to address some of them within my capacity. Coming from a third-world country, there are several socio-economic challenges that need to be addressed. I strongly believe that technology is instrumental in addressing some of our most pressing needs. It is also important to equip engineers in order to enhance their ability to tackle these issues.
52+
4. Will you be working on GSoC full-time? In case not, what will you be studying or working on while working on the project?
53+
- I can and would make arrangements to work on GSoC full-time. Continuous learning is imperative for any developer. I will be enhancing my skillset during GSoC as well as learning more about distributed systems and artificial intelligence.
54+
6. Do you mind regularly syncing up with the project mentors?
55+
- I will be available to sync up regularly with the project mentors for needed guidance and to speak on how the project is progressing.
56+
57+
7. What interests you the most about API Dash?
58+
- API Dash is a promising API client, being built using Flutter really defines what's possible with Flutter. It is promising for both the Flutter and the Developer community. The promise of incorporating AI in future releases is also very exciting. The responsiveness of API Dash maintainers is also really good.
59+
60+
8. Can you mention some areas where the project can be improved?
61+
- API Dash is on a good course. I have seen the **Roadmap** as well as other interesting ideas in the pipeline for GSoC. I would like to add that API Dash could have a web client and support live collaboration amongst teams.
62+
63+
### Project Proposal Information
64+
65+
1. Proposal Title
66+
- Adding Support for API Authentication Methods and API Dash Feature Improvements
67+
2. Abstract: A brief summary about the problem that you will be tackling & how.
68+
- Authentication Methods Overview
69+
1. Basic Authentication
70+
71+
Simple username/password transmission
72+
Credentials encoded in Base64
73+
Sent via HTTP Authorization header.
74+
75+
2. API Key Authentication
76+
77+
Single token for identifying application/user
78+
Can be sent via Request headers or
79+
Query parameters
80+
81+
3. Bearer Token Authentication
82+
83+
Uses access tokens for authorizationypically JWT-based
84+
Stateless authentication mechanism.
85+
86+
4. JWT Bearer Token
87+
88+
Self-contained authentication token contains encoded user claims
89+
Cryptographically signed which also supports token expiration and validation
90+
91+
5. Digest Authentication
92+
93+
Challenge-response authentication protocol which
94+
prevents sending plain-text credentials.
95+
96+
97+
6. OAuth 1.0
98+
99+
This is complex requiring multiple request-response cycles
100+
which provides secure delegated access.
101+
102+
7. OAuth 2.0
103+
104+
Supports various grant types allowomg third-party service authorization such as signing in with Google, Apple or Facebook.
105+
106+
Along with these, I intend on working on some of the API Dash Feature Improvements such as
107+
- Adding support for more content types in request
108+
- Importing from/Exporting to OpenAPI/Swagger specification
109+
- JSON body syntax highlighting, beautification, validation
110+
111+
3. Detailed Description
112+
113+
### Implementation Phases
114+
1. Initial Assessment
115+
116+
- Read technical documentations to gain insights on implementing these authentication strategies securely
117+
118+
2. Security Hardening
119+
120+
Implement HTTPS
121+
Using secure token transmission
122+
Add additional encryption layers
123+
Implement robust error handling
124+
125+
3. Validation and Testing
126+
127+
- Unit testing authentication flows
128+
- Simulating various authentication scenarios
129+
130+
- Implementation of theses would require the use of some of these packages at least <br/>
131+
*http:* For making HTTP requests <br/>
132+
*dart_jsonwebtoken:* JWT token handling <br/>
133+
*flutter_secure_storage:* Secure token storage <br/>
134+
*oauth1:* OAuth 1.0 implementation <br/>
135+
*crypto:* Cryptographic operations
136+
137+
1. Basic Authentication
138+
- For this implementation, I would essential create a class with a simple method
139+
```dart
140+
Future<http.Response> makeBasicAuthRequest(
141+
String url,
142+
String username,
143+
String password
144+
)
145+
```
146+
-- This method accepts the url for the request as well as the password needed for the request. <br>
147+
-- The username:password combination is then encoded to base64.
148+
-- This encoding would further be attached and sent as an `Authorization` Request in the HTTP headers like so `Basic $credentials` with $credentials representing the base64 encoded value.
149+
150+
2. API Key Authentication
151+
152+
```dart
153+
Future<http.Response> makeRequestWithHeaderApiKey(
154+
String url,
155+
String apiKey
156+
)
157+
```
158+
- apiKey is supplied via the `X-API-Key` HTTP header
159+
160+
```dart
161+
Future<http.Response> makeRequestWithQueryApiKey(
162+
String url,
163+
String apiKey
164+
)
165+
```
166+
- In the method, the apikey is supplied via a query parameter like so:
167+
`'$url?api_key=$apiKey'`.
168+
- This offers a different approach of including api key for a request.
169+
170+
3. Bearer Token Authentication
171+
```dart
172+
Future<http.Response> makeRequestWithBearerToken(
173+
String url,
174+
String token
175+
)
176+
```
177+
- token is supplied via the `Authorization` HTTP header like so `Bearer $token`
178+
4. JWT Bearer
179+
- A class with methods for generating JWT and verifying JWT
180+
```dart
181+
String generateJwt(String userId)
182+
```
183+
- Using the userId, or some alternative parameter, the [dart_jsonwebtoken](https://pub.dev/packages/dart_jsonwebtoken) can be used to generate and sign JWT
184+
- After generation and signing, the JWT has to be verified. The docs for `dart_jsonwebtoken` provides a good overview of how that could be achieved
185+
186+
```dart
187+
try {
188+
// Verify a token (SecretKey for HMAC & PublicKey for all the others)
189+
final jwt = JWT.verify(token, SecretKey('secret passphrase'));
190+
191+
print('Payload: ${jwt.payload}');
192+
} on JWTExpiredException {
193+
print('jwt expired');
194+
} on JWTException catch (ex) {
195+
print(ex.message); // ex: invalid signature
196+
}
197+
```
198+
199+
5. Digest Authentication
200+
- Digest Auth provides more secure form of authentication. We could make use of the [crypto](https://pub.dev/packages/crypto) dart package, which provides several implementations for hashing algorithms. This authentication mechanism also prevents sending plain-text credentials.
201+
An example of creating a hash is shown below:
202+
```dart
203+
final ha1 = md5.convert(
204+
utf8.encode('$username:$password')
205+
).toString();
206+
```
207+
208+
6. OAuth 1.0
209+
- This Dart library contains key implementations necessary for implementing authentication with OAuth 1.0 [OAuth1](https://pub.dev/packages/oauth1). Some key steps in using OAuth1 is as follows:
210+
```dart
211+
// Get temporary credentials
212+
final tempCredentials = await authorization.requestTemporaryCredentials(
213+
'https://callback-url.com'
214+
);
215+
216+
// Redirect user to authorization page
217+
final authorizationUrl = authorization.getResourceOwnerAuthorizationUrl(
218+
tempCredentials
219+
);
220+
221+
// After user authorization, get token credentials
222+
final tokenCredentials = await authorization.requestTokenCredentials(
223+
tempCredentials,
224+
verifier
225+
);
226+
```
227+
where `authorization` is an instance of the Authorization class which is created with client credentials and platform definition (Platforms include X, Apple, Google etc) provided by the aforementioned library.
228+
It is important to note however that the OAuth1.0 is being deprecated in favor of the 2.0 framework. Learn more [oauth1](https://oauth.net/core/1.0/) <br/>
229+
![oauth1](../gsoc/images/oauth1.png)
230+
231+
232+
7. OAuth 2.0
233+
- This is a modern authorization framework. Here is the docs for using the framework, [Oauth 2.0](https://oauth.net/2/) A typical class implementing OAuth would be as shown
234+
```dart
235+
class OAuth2Service {
236+
final String clientId;
237+
final String clientSecret;
238+
final String redirectUri;
239+
final String authorizationEndpoint;
240+
final String tokenEndpoint;
241+
242+
OAuth2Service({
243+
required this.clientId,
244+
required this.clientSecret,
245+
required this.redirectUri,
246+
required this.authorizationEndpoint,
247+
required this.tokenEndpoint
248+
});
249+
250+
// Generate authorization URL
251+
String getAuthorizationUrl() {
252+
return '$authorizationEndpoint?'
253+
'client_id=$clientId&'
254+
'redirect_uri=$redirectUri&'
255+
'response_type=code&'
256+
'scope=profile';
257+
}
258+
}
259+
```
260+
`clientId`: A unique identifier issued to your application when you register it with the OAuth provider. <br>
261+
`clientSecret`: A confidential secret known only to your application and the authorization server <br>
262+
`redirectUri`: The URL where the authorization server redirects the user after they approve/deny the authorization request <br>
263+
`authorizationEndpoint`: The URL at the authorization server where users are redirected to begin the OAuth flow. <br>
264+
`tokenEndpoint`: The URL at the authorization server used to exchange authorization codes for access tokens.
265+
266+
- Most these implementations would be made using Classes, unit and integration tests would be made for these classes and their methods. Integration testing would also be considered where appropriate.
267+
268+
269+
270+
4. Weekly Timeline: A rough week-wise timeline of activities that you would undertake.
271+
272+
- A week-wise timeline is shown below
273+
274+
| Week | Primary Focus | Key Activities | Deliverables/Outcomes |
275+
|------|--------------|----------------|----------------------|
276+
| Week 1 | Project Setup & Initial Research | - Review technical documentation for authentication strategies | - Comprehensive research report |
277+
| | | - Environment setup and dependency configuration | - Development environment setup |
278+
| Week 2 | Basic Authentication | - Implement `makeBasicAuthRequest` method | - Writing Basic Authentication class |
279+
| | | - Create secure base64 encoding functionality | - Unit tests for Basic Authentication |
280+
| | | - Add HTTPS implementation and security layers | - Basic security documentation |
281+
| Week 3 | API Key Authentication | - Implement header-based API key authentication | - API Key Authentication class |
282+
| | | - Implement query parameter-based API key authentication | - Writing API key authentication methods |
283+
| | | - Create secure storage mechanism for API keys | - Unit tests for API key methods |
284+
| Week 4 | Bearer Token Authentication | - Implement `makeRequestWithBearerToken` method | - Bearer Token Authentication class |
285+
| | | - Create token validation and verification | - Unit tests for token validation |
286+
| | | - Implement secure token storage | - Token security documentation |
287+
| Week 5 | JWT Implementation (Part 1) | - Set up `dart_jsonwebtoken` integration | - JWT generation functionality |
288+
| | | - Implement JWT generation method | - JWT verification method |
289+
| | | - Create token expiration handling | - Initial JWT testing framework |
290+
| Week 6 | JWT Implementation (Part 2) | - Implement error handling for JWT validation | - Complete JWT Authentication class |
291+
| | | - Add refresh token functionality | - Unit tests for JWT functionality |
292+
| | | - Create comprehensive JWT documentation | - JWT implementation documentation |
293+
| Week 7-8 | Digest Authentication | - Implement Crypto package integration | - Working Digest Authentication class |
294+
| | | - Create secure hash generation for credentials | - Hash verification functionality |
295+
| | | - Implement nonce and challenge handling | - Unit and integration tests |
296+
| Week 9 | OAuth 1.0 Implementation | - Set up OAuth1 package integration | - OAuth 1.0 implementation class |
297+
| | | - Implement temporary credentials request flow | - Authorization URL generation |
298+
| | | - Create token credentials handling | - OAuth 1.0 testing framework |
299+
| Week 10-11 | OAuth 2.0 Implementation | - Create OAuth2Service class | - Complete OAuth 2.0 implementation |
300+
| | | - Implement authorization URL generation | - Token endpoint integration |
301+
| | | - Add client ID/secret management | - OAuth 2.0 flow documentation |
302+
| Week 12 | Security Hardening | - Implement additional encryption layers | - Security audit report |
303+
| | | - Add robust error handling across all authentication methods | - Updated security documentation |
304+
| | | - Create secure token transmission mechanisms | - Security hardening test suite |
305+
| Week 13 | Integration Testing | - Create integration tests for all authentication flows | - Integration testing framework |
306+
| | | - Simulate various authentication scenarios | - Test coverage report |
307+
| | | - Fix issues discovered during testing | - Integration test documentation |
308+
| Week 14 | Performance Optimization | - Analyze authentication performance | - Performance optimization report |
309+
| | | - Implement caching mechanisms where appropriate | - Updated authentication classes |
310+
| | | - Optimize token refresh procedures | - Performance test results |
311+
| Week 15 | Documentation & Project Closure | - Create comprehensive API documentation | - Complete API documentation |
312+
| | | - Develop usage examples and guides | - Implementation examples |
313+
| | | - Finalize project and prepare for deployment | - Final project delivery report |
314+
315+
In summary this is an overview of the weekly timelines: <br>
316+
*Weeks 1-4:* Setup, research, and implementation of simpler authentication methods (Basic Auth, API Key, Bearer Token) <br>
317+
*Weeks 5-8:* Implementation of more complex authentication systems (JWT, Digest Authentication)
318+
*Weeks 9-11:* OAuth implementations (both 1.0 and 2.0) <br>
319+
*Weeks 12-15:* Security hardening, testing, optimization, and documentation
320+
321+
322+

‎doc/proposals/2025/gsoc/images/oauth1.png‎

127 KB
Loading

0 commit comments

Comments
 (0)