# ToDo
* Public page with instructions

# Authentication
Authentication consists of the following parts:
* `next-auth` boilerplate
    * `middleware.ts` = hooks-up `next-auth` into the page processing pipeline - user session is checked before any page is rendered 
    * `auth.ts` = defines how the authentication is done, and how session is checked (used by middleware)
    * `/app/api/[...nextauth]/route.ts` = defines route which shows an authentication form

Source:
* [How to Implement Google Authentication in a Next.js App Using NextAuth](https://www.telerik.com/blogs/how-to-implement-google-authentication-nextjs-app-using-nextauth)
* [Next Js 14 Authentication on Edge Runtime](https://www.youtube.com/watch?v=rEopVx0FKGI)

# Multi-User Support
Each location record is marked with a user ID.

All the actions user `withUser` to fetch user ID, which is then used in all the DB operations.

# Deploying
The deployment is done via Docker:
* build docker image
* deploy Docker service

## Building Docker image
Run the following command:
```bash
docker build . -t utility-bills-tracker:1.0.0
```
The image will be stored in the local Docker instance.

## Deploying Docker service
Run the following command:
```bash
docker stack deploy \
    -c docker-compose-deploy.yml \
    utility-bills-tracker
```

# Implementation details
## Issues with HOSTNAME
When deplyed via docker and published via Cloudflare there's an issue with `HOSTNAME` env variable:
* if left unset, the server will use IP address assigned to container by Docker (i.e. 10.0.20.3) and **will not accept connections from outside**
```
▲ Next.js 14.0.2
- Local:        http://68db6c9ebafe:80
- Network:      http://10.0.20.3:80
```
* if set to "0.0.0.0" the server will serve static pages, but will *reject API calls when submitting form*
```
▲ Next.js 14.0.2
- Local:        http://localhost:80
- Network:      http://0.0.0.0:80

utility-bills-tracker_web-app.1.Error: Invalid Server Actions request.

`x-forwarded-host` header with value `0.0.0.0:80` does not match `origin` header with value `rezije.app` from a forwarded Server Actions request. Aborting the action.
```
* if set to "rezije.app" the server will not start since the IP address it resolves with the given FQDN does not match any of the IP addresses assigned to the container
```
▲ Next.js 14.0.2
- Local:        http://localhost:80
- Network:      http://0.0.0.0:80

utility-bills-tracker_web-app.1.Error: Invalid Server Actions request.

`x-forwarded-host` header with value `rezije.app:80` does not match `origin` header with value `rezije.app` from a forwarded Server Actions request. Aborting the action.
```

So there are the following issues:
* server will not accept external request - can be fixed by setting `HOSTNAME` to `0.0.0.0`
* server rejects API requests - can be fixed by adding `serverActions.allowedOrigins` option to `nextjs.config.js` file

So these are the fixes which were implemented in order to be able to run server in production.

This is a hack indicating that I don't understand how the damn thing should be configured!

Even when this hack is emplyed the server still logs the followig error:
```
failed to get redirect response TypeError: fetch failed
    at Object.fetch (node:internal/deps/undici/undici:11730:11)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {
  cause: Error: connect ECONNREFUSED 0.0.0.0:443
      at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1555:16)
      at TCPConnectWrap.callbackTrampoline (node:internal/async_hooks:128:17) {
    errno: -111,
    code: 'ECONNREFUSED',
    syscall: 'connect',
    address: '0.0.0.0',
    port: 443
  }
}
```

## Mongo DB & AVX Instructions
The MongoDB server v > 5.0 will not run on and old machine such as Acer Revo due to it's CPU.

This issue was solved by using an older Mongo DB Version 4.4.27

# OAuth verification video transcript

This is Rachini app demonstration for Google OAuth login process for the users of our app.
The video shows that our usage of OAuth scopes complies with Google API services user data policy.

Our app does not use any of the sensitive and restricted scopes.

User's can access Terms of service and Privacy policy by clicking links in footer of the page.
Links to these pages are assigned in the apropriate fields in the Google's Cloud Console and are listed in the Google's OAuth window.

From our homepage you can login by clicking on the "Sign in with Google" button.

Here in the address bar you can see that the client ID is present in the URL.

Select the account with which you would like to sign-in with and you will be logged in into the app.

We are using two scopes:
1. OAuth ID, which is used to assign ownership to the application specific data when it's is stored and retrieved from our database.
2. user's e-mail address, which stored in our database so that we can contact our users in case such action is needed.

For any questions regarding the use of the Google API service please feel free to reach out at support@racuni.app