some fixes

- replace Basic Auth with JWT
- add local apiator copy
- redo the frontend to take advantage of apiator

Author: vsergione

README.md

@@ -4,7 +4,7 @@ A RESTful API for managing CSV files with JSON:API specification compliance. Thi
 
 ## Features
 
-- Basic Authentication
+- JWT Authentication
 - JSON:API specification compliance
 - File operations (list, upload, delete)
 - Record operations (CRUD)
@@ -35,9 +35,10 @@ A RESTful API for managing CSV files with JSON:API specification compliance. Thi
     chmod 777 data
     ```
 
-3. Update the constant `csv_api.php` storing the path to the data directory.
+3. Update the constants in `api.php`:
 
     ```php
+    define('JWT_SECRET', 'your-secure-secret-key');  // Change this to a secure secret
     define('DATA_DIR', __DIR__.'/data');
     ```
 
@@ -50,27 +51,82 @@ A RESTful API for managing CSV files with JSON:API specification compliance. Thi
 
 ## Authentication
 
-The API uses Basic Authentication. Default credentials:
+The API uses JWT (JSON Web Token) authentication. Default credentials:
 
 - Username: `admin`
 - Password: `secret123`
 
-To change the credentials, modify the constants in `csv_api.php`:
+### Login Endpoint
+
+To authenticate, make a POST request to the login endpoint:
+
+```http
+POST /api/auth/login
+Content-Type: application/json
+
+{
+    "username": "admin",
+    "password": "secret123"
+}
+```
+
+Response:
+
+```json
+{
+    "data": {
+        "type": "auth_token",
+        "id": "login",
+        "attributes": {
+            "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
+            "expires_in": 3600,
+            "token_type": "Bearer"
+        }
+    }
+}
+```
+
+### Using the Token
+
+Include the JWT token in the Authorization header for all subsequent requests:
+
+```http
+Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...
+```
+
+### Security Configuration
+
+To change the credentials and security settings, modify the constants in `api.php`:
 
 ```php
-define('AUTH_USERNAME', 'your_username');
-define('AUTH_PASSWORD', 'your_password');
-define('DATA_DIR', __DIR__.'/data');
+// JWT Configuration
+define('JWT_SECRET', 'your-secure-secret-key');  // Use a strong, random secret
+define('JWT_ALGORITHM', 'HS256');
+define('JWT_EXPIRY', 3600); // Token expiry in seconds
+
+// User credentials (in production, use a database)
+$validUsers = [
+    'admin' => password_hash('your_password', PASSWORD_DEFAULT)
+];
 ```
 
 ## API Endpoints
 
+### Authentication
+
+#### Login
+
+```http
+POST /api/auth/login
+```
+
 ### File Management
 
 #### List Files
 
 ```http
 GET /api/csv
+Authorization: Bearer <token>
 ```
 
 Response:
@@ -98,6 +154,7 @@ Response:
 
 ```http
 POST /api/csv
+Authorization: Bearer <token>
 Content-Type: multipart/form-data
 
 file: <csv_file>
@@ -123,16 +180,23 @@ Response:
 
 ```http
 DELETE /api/csv/{filename}
+Authorization: Bearer <token>
 ```
 
-Response: 204 No Content
+### Record Operations
 
-### Record Management
+#### Get All Records
 
-#### List Records
+```http
+GET /api/csv/{filename}
+Authorization: Bearer <token>
+```
+
+With pagination:
 
 ```http
 GET /api/csv/{filename}?page[offset]=0&page[limit]=10
+Authorization: Bearer <token>
 ```
 
 Response:
@@ -151,7 +215,11 @@ Response:
         }
     ],
     "meta": {
-        "total": 1
+        "total": 1,
+        "page": {
+            "offset": 0,
+            "limit": 10
+        }
     }
 }
 ```
@@ -160,47 +228,32 @@ Response:
 
 ```http
 GET /api/csv/{filename}/{id}
-```
-
-Response:
-
-```json
-{
-    "data": {
-        "type": "example",
-        "id": "0",
-        "attributes": {
-            "id": "1",
-            "name": "John Doe",
-            "email": "john@example.com"
-        }
-    }
-}
+Authorization: Bearer <token>
 ```
 
 #### Create Record
 
 ```http
 POST /api/csv/{filename}
+Authorization: Bearer <token>
 Content-Type: application/vnd.api+json
 
 {
     "data": {
         "attributes": {
-            "id": "2",
-            "name": "Jane Smith",
-            "email": "jane@example.com"
+            "id": "3",
+            "name": "Bob Wilson",
+            "email": "bob@example.com"
         }
     }
 }
 ```
 
-Response: 201 Created
-
 #### Update Record
 
 ```http
 PUT /api/csv/{filename}/{id}
+Authorization: Bearer <token>
 Content-Type: application/vnd.api+json
 
 {
@@ -214,49 +267,25 @@ Content-Type: application/vnd.api+json
 }
 ```
 
-Response: 200 OK
-
 #### Delete Record
 
 ```http
 DELETE /api/csv/{filename}/{id}
+Authorization: Bearer <token>
 ```
 
-Response: 204 No Content
-
-### Search and Structure
-
 #### Search Records
 
 ```http
-GET /api/csv/{filename}/search?name=John&exact=true&page[offset]=0&page[limit]=10
-```
-
-Response:
-
-```json
-{
-    "data": [
-        {
-            "type": "example",
-            "id": "0",
-            "attributes": {
-                "id": "1",
-                "name": "John Doe",
-                "email": "john@example.com"
-            }
-        }
-    ],
-    "meta": {
-        "total": 1
-    }
-}
+GET /api/csv/{filename}/search?{field}={value}&exact=true
+Authorization: Bearer <token>
 ```
 
 #### Get File Structure
 
 ```http
 GET /api/csv/{filename}/structure
+Authorization: Bearer <token>
 ```
 
 Response:
@@ -306,13 +335,14 @@ A web interface is available for managing CSV files. To use it:
 
 1. Open `index.html` in a web browser
 2. Log in with the default credentials (admin/secret123)
-3. Use the interface to:
+3. The interface will automatically handle JWT token management
+4. Use the interface to:
    - Upload CSV files
    - View file contents
    - Edit records
    - Delete files and records
    - Search records
-4. Double click on the row to open the edit row dialog
+5. Double click on the row to open the edit row dialog
 
 ## Testing
 
@@ -325,11 +355,13 @@ composer install
 
 ## Security Considerations
 
-1. Change the default authentication credentials
-2. Ensure the data directory is not publicly accessible
-3. Validate file uploads
-4. Implement rate limiting in production
-5. Use HTTPS in production
+1. Change the default JWT secret to a secure, random value
+2. Use HTTPS in production
+3. Implement proper user management in production (database instead of hardcoded users)
+4. Consider implementing token refresh mechanisms
+5. Ensure the data directory is not publicly accessible
+6. Validate file uploads
+7. Implement rate limiting in production
 
 ## License