As time from last known, increases, the confidence aka opacity, decreases. By
11 minutes, the prediction starts to aggresively deviate towards means in ways
that are not believable, as Adrien de Croy points out. This makes the
prediction start to fade out by 12 minutes in. By 30 minutes out, the
prediction is invisible, and requires straining to see after 15 minutes.
@jasoncalabrese pointed out that some agents do odd things with
underscores and that using a hyphen is more common.
This also adds tests to ensure that the API_SECRET handling works as
expected.
@jasoncalabrese pointed out that some agents do odd things with
underscores and that using a hyphen is more common.
This also adds tests to ensure that the API_SECRET handling works as
expected.
Try regenerating a new default deploy.sh using:
azure site deploymentscript --node
The old one caused problems because I re-ordered
things without understanding what Kudu was doing,
fully. The bower install is now part of the npm
install process, which means this shoudn't really
be necessary.
This changes causes the server to crash if the API_SECRET environment
variable has a value whose length is less than MIN_PASSPHRASE_LENGTH
characters.
The default MIN_PASSPHRASE_LENGTH is 12, so if the API_SECRET variable
is set but less than 12 characters long, the server will crash.
security/privacy review needed
==============================
The API_SECRET is used as a pass phrase in order to generate a unique
token.
The api routes always try to mount themselves. Before mounting
sensitive routes that allow modifying the application, the secret
token is required to validate the request, or denied.
When the secret token is absent, the sensitive routes should return
404, and should not be mounted.
This change attempts to eliminate some dangerous middle ground between
having a secured api, having a weakly secured api, believing a secure
api is mounted and working when none is, and not having a secure api
mounted.
The only choices available should be:
* secure api mounted
* secure api not mounted
This change hopefully constrains the possibilities to those two
options.
Rename a few things here and there to help clarify the situation.
This change introduces use of express.Router( ), which provides the routing
functions of express without the full app.
This also shows an experiment observing the interaction betwen express( ) and
express.Router( ).
There are a few reasons for doing this:
Using express.Router( ) allows introspecting existing routes.
As a REST application, our content payloads should include URLs, links to other
resources available from our API. As a bonus feature, it's often nice for a
meta page to describe the links, status, and version available from this
particular API. By far, the easiest way to implement this is to introspect the
existing routes.
Separating the code makes testing easier.
This lays the ground work for breaking apart the code into smaller, more
testable modules.
The api function now returns something useful in addition to doing a little bit
of work.
It used to do a little bit of work, now it returns the result.
Also, the NIGHTSCOUT_STATIC_FILES environment variable can be used to point to
an arbitrary location of files to serve.
By default, it uses the `static` directory included in the package.
Also try to encourage trimming columns to <80.
Remove the global environment variables holding configuration.
Instead, this allows the server to consistently refer to the same
configuration everywhere.
This sets up two additional API endpoints explicitly used for testing.
Also, constrain all parsing of environment variables to a single
location.
This change also creates no API at all unless there is an API secret
defined.
Also the API_SECRET is really just a shared key private key, we
actually use the sha1 sum digest of the key.
A number of people using recent sources experimenting with
caches will need to bust the cache at least once. While we have
correct caching implemented now, the previous caching
implementation requires one busting in order to clear things
through.
Ben West
