API: device auth and secure measurement sync (F0+F1)#1
Merged
Conversation
F0 skeleton + F1 authorization + robust upload synchronisation. - Django 5 + django-ninja + psycopg3 + PostgreSQL; docker-compose (MeteorPointer-DB + MeteorPointer-API); CI (ruff+pytest) + GHCR release. - devices: anonymous Ed25519 device identity, one-time recovery phrase, consent recording (version+sha256), revoke, data/account deletion. - auth_api: challenge -> signed nonce -> short-lived JWT. - ingest: ingest-first/parse-later. POST /v1/reports only authenticates and stores the raw payload in a landing table, returns 202; idempotent per (device, client_key) so dropped-connection retries are safe. Parsing is deliberately deferred. - legal: serves canonical CC0 consent docs with sha256. Tests cover the full consent -> register -> token -> batch sync flow incl. idempotency. All green; ruff clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Co přináší
Skeleton API (F0), autorizace (F1) a bezpečná synchronizace měření z mobilu.
Stack
Django 5 + django-ninja + psycopg3 + PostgreSQL · docker-compose
(
MeteorPointer-DB+MeteorPointer-API) · CI (ruff + pytest) + GHCR release.Aplikace (
backend/apps/)(ukládá se jen hash), evidence souhlasu (verze + sha256 + locale + čas),
revokace, mazání dat i celé identity.
challenge→ podepsaný nonce → krátkodobé JWT.POST /v1/reportsjen ověří JWT auloží syrový payload do landing tabulky, vrátí 202. Idempotentní na
(device, client_key)→ opakování při výpadku spojení je bezpečné. Parser jezáměrně odložený (zpracování měření řešíme zvlášť).
Odolnost vůči slabému připojení
client_key→ bezpečné retry do 202Testy
End-to-end: consent → register → token → batch sync vč. idempotence.
Vše zelené, ruff čistý (ověřeno v Dockeru proti Postgresu).
Mimo rozsah (záměrně)
Parser
raw_ingest→Report, web login (device flow), mobilní klient(větev
Autorizace), web FE.🤖 Generated with Claude Code