tomh104/nat-as-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

securing translation endpoint
Some checks failed
PHPUnit / test (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Tom Hempel
2026-07-18 13:40:06 +02:00
parent 154535edc2
commit 06d53c564e
4 changed files with 133 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
docs/android-questionnaire-api.md
View File

@ -348,7 +348,11 @@ Common failures:
`GET /api/app_questionnaires?translations=1`
**Authentication:** not required. The Android app calls this on the login screen before the coach signs in. All other `app_questionnaires` routes still require `Authorization: Bearer <token>`.
**Authentication:** required (`Authorization: Bearer <token>`). Fetched during post-login sync.
`GET /api/app_questionnaires?loginTranslations=1`
**Authentication:** not required. Returns only login-screen keys (`auth_*`, `help_auth_*`, password hints/rules, and related buttons). The app fetches this on the login screen; built-in DE/EN fallbacks still apply if offline.
Success:
@ -392,15 +396,16 @@ Android should apply this map while a questionnaire is open (overlay on top of a
## Recommended Android Sync Flow
1. On app start (login screen), fetch app UI translations with `GET /api/app_questionnaires?translations=1` (no token) and cache locally.
1. On the login screen, optionally fetch `GET /api/app_questionnaires?loginTranslations=1` (no token) and cache locally; built-in DE/EN strings cover offline.
2. Login with `/api/auth/login` and store the returned token securely (EncryptedSharedPreferences on Android).
3. Fetch the assigned client list with `GET /api/app_questionnaires?clients=1` (coach role only).
4. Re-fetch app UI translations optionally after login (same public endpoint, or authenticated refresh).
3. Fetch app UI translations with `GET /api/app_questionnaires?translations=1` (Bearer token required) and cache locally.
4. Fetch the assigned client list with `GET /api/app_questionnaires?clients=1` (coach role only).
5. Fetch the active questionnaire list with `GET /api/app_questionnaires`.
6. For each list item, fetch details with `GET /api/app_questionnaires?id=<id>` (includes per-questionnaire `translations`).
7. Cache the client list, app translations, the questionnaire list, and questionnaire details (with embedded translations) locally for offline use.
8. When a questionnaire is completed, upload answers with `POST /api/app_questionnaires` using an **encrypted** JSON envelope (see above).
There is currently no version or `updatedAt` field in the app fetch response, so the safest refresh strategy is to re-fetch translations, list, and details at login or app start when network is available.
There is currently no version or `updatedAt` field in the app fetch response, so the safest refresh strategy is to re-fetch translations, list, and details when syncing with the server.
## Android local data security