InstiMaster

Overview

InstiMaster is a sophisticated backend application designed for the efficient management of institutes. It offers a comprehensive set of REST APIs to facilitate the complete lifecycle of institutes, encompassing Create, Read, Update, and Delete (CRUD) operations. With a robust login system and access control mechanisms based on user roles, InstiMaster ensures secure operations. Security features include protection against potential attacks such as Cross-Site Scripting (XSS) through the implementation of security tools like JSON Web Token (JWT), Cross-Site Request Forgery (CSRF), and Cross-Origin Resource Sharing (CORS). The application seamlessly integrates with PostgreSQL 16 as its backend database.

Exposed APIs

1. GetCSRF

   • Endpoint: /getCSRF
   • Description: Retrieves the CSRF token for secure transactions.

2. CreateUser

   • Endpoint: /createUser
   • Description: Creates a new user account.

3. Login

   • Endpoint: /login
   • Description: Handles user login, providing a JWT for user context. Raises a UserNotFoundException if the user is not found.

4. CreateInstitute

   • Endpoint: /createInstitute
   • Description: Adds a new institute to the database.

5. GetInstitutes

   • Endpoint: /getInstitutes
   • Description: Retrieves a list of all institutes from the database.

6. GetInstituteById

   • Endpoint: /getInstituteById/{id}
   • Description: Retrieves detailed information about an institute based on its ID.

7. UpdateInstitute

   • Endpoint: /updateInstitute/{id}
   • Description: Updates the details of an existing institute. Raises an InstituteNotFoundException if the institute is not found.

8. DeleteInstitute

   • Endpoint: /deleteInstitute/{id}
   • Description: Removes an institute from the database.

Technology Stack

1. Java 17

   • The required version for running the application.

2. Spring Boot 3.2.2

   • A powerful framework for creating REST APIs.

3. Spring Web

   • A component facilitating REST API creation.

4. Spring Security

   • Ensures application security through the implementation of CSRF, JWT, and CORS.

5. PostgreSQL 16

   • The chosen backend database for data storage.

6. SpringBoot Validation

   • Ensures validation of input data.

7. Hibernate ORM

   • Manages input validation and SQL manipulation.

8. Mockito, JUnit5

   • Utilized for unit testing purposes.

9. Spring TestContainers

   • A tool for facilitating integration tests.

10. Lombok

    • A code generation tool enhancing code readability and maintainability.

11. OpenApi/Swagger

    • Generates comprehensive API documentation.

12. Docker

    • Enables containerization of the application, streamlining deployment.

13. Additional Dependencies

    • GSON, Apache HttpClient, BeanUtils.

Getting Started

1. Clone the Repository

   git clone <repository_url>

2. Navigate to the Project Directory

   cd InstiMaster

3. Run docker compose

   docker-compose up

The appThe application will be accessible upon the successful execution of the above steps. For detailed API documentation, refer to the Swagger documentation generated by the application.

Application URL: https://localhost:8080

Swagger Documentation URL: https://localhost:8080/swagger-ui/index.html#/

Note: Ensure that Docker and Docker Compose are installed on your machine before running the application.

Possible Improvements

1. CSRF Token Configuration:

Enhance the CSRF token configuration for improved security. Consider implementing additional measures such as:

• Token Rotation: Implement a strategy for rotating CSRF tokens periodically to minimize the risk associated with token leakage or misuse.

• Custom Headers: Consider using custom headers for CSRF tokens instead of relying solely on cookies. This can provide an extra layer of security against certain types of attacks.

2. Localization of the App:

Enable localization features to cater to a broader audience. This involves:

• Internationalization (i18n): Implement internationalization support to allow the application to be presented in multiple languages. Utilize resource bundles or externalized messages for dynamic content.

• Localization Settings: Provide user-specific localization settings, allowing users to choose their preferred language within the application.

3. Setting Up Development Stages:

Enhance the development environment and workflow by implementing the following practices:

• Environment Configuration: Establish distinct configurations for development, testing, and production environments to ensure consistency and minimize issues during deployment.

• Continuous Integration/Continuous Deployment (CI/CD): Implement CI/CD pipelines to automate testing and deployment processes, facilitating faster and more reliable releases.

• Development Database Seeding: Develop a mechanism for easily seeding development databases with sample data to facilitate testing and development.

4. Swagger Integration Improvement:

Optimize Swagger integration for better API documentation and usability:

• Detailed Endpoint Descriptions: Enhance Swagger documentation with detailed descriptions, examples, and request/response models to provide comprehensive information about each API endpoint.

• Grouping and Tagging: Group and tag API endpoints based on functionality or module, making it easier for users to navigate and understand the API structure.

• Interactive Documentation: Incorporate interactive features into Swagger UI, allowing users to make API requests directly from the documentation for a more hands-on experience.

• Security Definitions: Clearly define and document security requirements for each API endpoint, including authentication mechanisms, within the Swagger documentation.

• Access Control via Proxy: We can create a User Proxy and then based on the roles that the user is having, we can restrict access to specific functionality.

By implementing these improvements, we can enhance the security, accessibility, and overall development experience of the InstiMaster application.