diff --git a/README.md b/README.md index 712a08e..2622e0b 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,9 @@ -# Abuse Registration API POC +# Golang API Example: Abuse Registration API -A stripped-down, in-memory API proof-of-concept. It keeps the important authentication shape from the original API while removing backend/database business logic. - -The demo data is synthetic, stored in memory, and reset to the base dataset every 10 minutes. The base dataset contains 546 rows with `registered_at` dates from 1988 through 1991. - -The HTML template, CSS, JavaScript, and favicon are embedded with Go `embed`. A built binary can be copied and run by itself; it does not need a neighboring `static/`, `templates/`, or `favicon.ico` file. - -The JSON model is intentionally small: +In-memory API example, resets to the base dataset every 10 minutes. +100% self contained binary +json model: ```json { "id": "bb8d39a6-8fef-48af-9f9c-27a41c8f8baf", @@ -39,50 +35,12 @@ Then open: http://localhost:8080/ ``` -Optional environment variables: +Optional env vars: ```bash PORT=:9999 JWT_SECRET=change-me RESET_INTERVAL=10m go run ./cmd/api ``` -## Build - -The Taskfile follows the FLÓ-style build version format: - -```text -version [-/-]. git is [clean|dirty]. -``` - -`build/words.txt` is copied from the FLÓ website project. - -```bash -task build -./bin/abuse-registration-poc -``` - -The resulting `./bin/abuse-registration-poc` is self-contained. You can copy just that file to another Linux host and run it. - -## Project layout - -The POC is intentionally small, but it is no longer a single-file prototype. The code is split in the same broad shape as the original API: - -```text -cmd/api/main.go binary entry point and flags -internal/config environment/default configuration -internal/models user and registration models plus allowed values -internal/auth static POC users replacing the auth database -internal/utils JWT and UUID helpers -internal/store in-memory registration store and reset logic -internal/handlers HTTP handlers for login, health, page, and data -internal/middlewares authentication, authorization, and CORS -internal/routes route registration and protected route wiring -internal/web/templates/index.html single HTML page template, embedded into the binary -internal/web/static embedded CSS and browser JavaScript -internal/web/favicon.ico embedded favicon -``` - -The real database/repository layer is deliberately replaced by `internal/store`, but the login response shape, raw `Authorization` JWT usage, role split, and route-permission middleware are kept close to the original API. Web assets are separate source files, but are compiled into the binary at build time. - ## Demo users | User | Password | Role | Access | @@ -92,8 +50,8 @@ The real database/repository layer is deliberately replaced by `internal/store`, ## Auth workflow -The site does not contain a login form and does not acquire a token in the browser. Use curl or PowerShell only. - +Use curl or PowerShell. +If using the website hosted api, replace localhost:8080 with https://go-api.poc.fló.fo Reader with curl: ```bash @@ -155,10 +113,9 @@ curl -s -X DELETE "http://localhost:8080/api/v1/registrations/$CREATED_ID" \ Public: -- `GET /` returns the single HTML page only. It does not embed all 546 registrations into the HTML. - `GET /health` - `POST /login` -- `GET /demo/registrations` is the public demo snapshot used by the page JSON viewer. +- `GET /demo/registrations` Protected read: @@ -174,8 +131,6 @@ Admin create/read/update/delete: - `DELETE /api/v1/registrations/{uuid}` - `POST /api/v1/reset` -Unknown normal pages return a plain text message. Unknown `/api/...` routes return JSON. - ## Allowed values Allowed `gender` values: @@ -197,13 +152,11 @@ Allowed `abuse_type` values: - `threats` - `honor_related` -Allowed `location` values are fixed to the included Faroese town/village list in `internal/models/registration.go`. The browser filter dropdown uses this same list, and create/update rejects anything else. - Filters for `GET /api/v1/registrations` and `/demo/registrations`: - `abuse_type` - `gender` -- `location` — exact match against the fixed list +- `location` - `status` - `from` and `to`, matched against `registered_at`, accepting `YYYY-MM-DD` or RFC3339 values - `search`