Record all signup attempts in DB

[fhartwig]

This is a sort of work-in-progress on https://tree.taiga.io/project/fisx-thentos/task/44
It could probably need some more tests and I'm still working on CSV output for the new api endpoint, but apart from that I think it's ready for review.

[fisx]

missing empty line.

[fisx]

otherwise looks good!

[ChristianSi]

Though I notice it's a requirement, I'm very much against adding a publicly accessible endpoint (registration_attempts) revealing such sensitive information. Alternatives:

• Don't make this part of the API at all, instead write a little Perl script that reads the DB table and converts it into csv format.
• If part of the API, make sure that the endpoint is only accessible from certain configurable IPs (default: localhost).

[fisx]

as agreed offline: let's go for the privileged-ip solution.

On Tue, Dec 15, 2015 at 10:02:38AM -0800, Christian Siefkes wrote:

Though I notice it's a requirement, I'm very much against adding a publicly accessible endpoint (registration_attempts) revealing such sensitive information. Alternatives:

• Don't make this part of the API at all, instead write a little Perl script that reads the DB table and converts it into csv format.
• If part of the API, make sure that the endpoint is only accessible from certain configurable IPs (default: localhost).

[fhartwig]

I didn't get around to doing the IP authentication. I'm unassigning myself as I'll be away for the next 2 weeks. Apart from the authentication issue, I think this is good to review/merge.

[fisx]

See also: haskell-hvr/cassava#107

[fisx]

What about using hs-logger for this? We could define a dedicated variant of logger that takes all the information on the event (signup attempt in this case), stores it to a dedicated Logger (which goes to a separate file), and then do all the processing of this file outside of the thentos server process?

Benefits:

• @fhartwig, I suspect you might like that because it obsoletes the idea of using PrivilegedIP for authorization in the retrieval action (see Privileged IPs #420).
• It would also be a lot more extensible: If we come accross some pattern of requests (either for thentos or for adhocracy) that we want to keep an eye on, we can easily and rapidly add them.
• It would also be nice to be able to patch the analytics code independently of the production server.

[fhartwig]

Closing this in favour of #445