<commit_before># Project
The Couple's Diary is a place where two people can write in a shared diary.

# Version 2
In the second version the focus will be on the looks of the website.
It will also use GraphQL and Relay to learn some new web technologies.

# Authentication
JSON Web Tokens (JWT) will be used for authentication (and authorization).
Once a user logs in, two tokens will be created.
One token last for 1 hour and the other one lasts for all eternity.
The token with a short life-span is called *access token*, and the other *refresh token*.
The refresh token is on a per-client basis, allowing blacklisting.
## Access token
The access token will be used for authorization.
It will be included in the HTTP-headers for every call to the API.
If it's valid, the call will be allowed.
If the token has expired, a new access token must be generated.
A new token can be generated by using the refresh token.
## Refresh token
The refresh token is used to generate a new access token.
It's important that the refresh token is kept secret, as it's able to generate an unlimited number of access tokens.
The storing strategy of the refresh token has yet to be decided, but one method is to store it in a cookie with `httpOnly` flag (and `secure`).
The other method is to simply store it in `localStorage`.
The issue with the former is that it's vulnerable to Cross Site Request Forgery (CSRF/XSRF).
The latter method is vulnerable to Cross Side Scripting (XSS).

## Application flow
The `access token` is sent as the value of the `Authorization` header.
If the token is valid, the user gets fetched using the UUID in the token and propagated to the _resolvers_ via the GraphQL _context_.
If the token is missing or invalid the user passed in the context will be null.
It's then up to each resolver to ensure that the (now null) user is denied access.<commit_msg>Updated README for application flow<commit_after># Project
The Couple's Diary is a place where two people can write in a shared diary.

# Version 2
In the second version the focus will be on the looks of the website.
It will also use GraphQL and Relay to learn some new web technologies.

# Authentication
JSON Web Tokens (JWT) will be used for authentication (and authorization).
Once a user logs in, two tokens will be created.
One token last for 1 hour and the other one lasts for all eternity.
The token with a short life-span is called *access token*, and the other *refresh token*.
The refresh token is on a per-client basis, allowing blacklisting.
## Access token
The access token will be used for authorization.
It will be included in the HTTP-headers for every call to the API.
If it's valid, the call will be allowed.
If the token has expired, a new access token must be generated.
A new token can be generated by using the refresh token.
## Refresh token
The refresh token is used to generate a new access token.
It's important that the refresh token is kept secret, as it's able to generate an unlimited number of access tokens.
The storing strategy of the refresh token has yet to be decided, but one method is to store it in a cookie with `httpOnly` flag (and `secure`).
The other method is to simply store it in `localStorage`.
The issue with the former is that it's vulnerable to Cross Site Request Forgery (CSRF/XSRF).
The latter method is vulnerable to Cross Side Scripting (XSS).

## Application flow
The `access token` is sent as the value of the `Authorization` header.
If the token is valid, the user gets fetched using the UUID in the token and propagated to the _resolvers_ via the GraphQL _context_.
If the token is missing or invalid the user passed in the context will be null.
It's then up to each resolver to ensure that the (now null) user is denied access.
If the user is denied, a custom GraphQL error will be thrown.
{'fraction_non_alphanumeric': 0.04195070791819612, 'fraction_numerical': 0.001048767697954903, 'mean_word_length': 4.169376693766938, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1580139', 'n_tokens_mistral': 975, 'n_tokens_neox': 942, 'n_words': 667}