User accounts

[max-mapper]

me and @clkao started hacking on this today in taipei

• add login/logout UI
• add login/logout choo hooks
• add auth0
• show user avatar when logged in/signing up
• tests

[max-mapper]

working from these mockups:

[okdistribute]

awesome! got integration going on the desktop app, is pretty straight forward: https://github.com/juliangruber/dat-desktop/pull/55

[okdistribute]

there are a few issues with auth0-lock library that make this annoying to integrate

[okdistribute]

I added a simple login form and played around with auth0-js and auth0 libraries. There seems to be two different libraries for client-side and server-side, although I'm not sure that the auth0 library can't be used for client-side as well with the telemetry: false option -- I haven't tried.

Doing it this way means we have to implement our own /user/callback to get the token, which right now is server-side. Maybe there's a better way to do it that would be completely client-side, which would mean the app in choo would need to grab the token from the url and perhaps redirect to the profile page. @yoshuawuyts have you seen anyone do this with choo before?

I got a little stuck and frustrated with this with these two poorly documented libraries on npm. @clkao @maxogden i remember you saying that you were able to use the management api to get lists of users and add metadata, were you using the auth0 library management client?

[yoshuawuyts]

@Karissa people have brought it up before yoshuawuyts/sheet-router#15; all that's needed from choo is for the send('location:set') call to work correctly / allow window.location.href = to work as expected, which I think both do already

I haven't done any auth stuff, but asked around on #choo and was linked to CodeForPhilly/stately as an example of prior art. This doesn't perform an oAuth like flow though, and it breaks slightly with the choo paradigm.

In IRC we discussed of how better to perform authenticated xhr requests, and wrapping xhr and passing a flag for when auth is required might seem like a reasonable option. This concerns itself more with the application side of things though.

@Karissa does this somewhat answer your question?

---

raw IRC logs

13:37:06 <timwis> yoshuawuyts: yeah, in 2 projects. one with couchdb, another with a rest api based auth
13:37:17 <yoshuawuyts> timwis: ah cool - did you do any openauth like stuff?
13:37:24 <timwis> here's the most recent one (the latter) https://github.com/CodeForPhilly/stately/blob/master/client/src/index.js
13:37:35 <yoshuawuyts> timwis: anything that wasn't great?
13:37:39 <timwis> no, no oauth stuff with choo
13:37:56 <timwis> yeah, i'd say what i just linked isn't "great" -- it requires breaking the paradigm a bit
13:38:11 <timwis> you can see i queried an API before initialising choo
13:38:18 <timwis> had to do the same thing with the couchdb work
13:38:35 <yoshuawuyts> timwis: oh yeah that doesn't sound great indeed
13:38:50 <yoshuawuyts> timwis: what was the reason you did that?
13:39:11 <timwis> because that's how you set the session which all the other requests will depend on
13:39:46 <timwis> and i couldn't think of a way to hit the "authenticate" endpoint, and wait for it to finish before any of the other requests fire
13:39:59 <yoshuawuyts> timwis: ah right, that makes sense - could perhaps another approach be to create a stateful xhr wrapper that queues requests until the token is set?
13:40:30 <timwis> yes. funny, i thought of that and thought i sounded ridiculous, but interesting that i'm not the only one
13:40:47 <timwis> the worry i have is that it's kind of hidden/magical
13:41:12 <yoshuawuyts> timwis: hahaha; welp if two humans think of it....
13:41:32 <timwis> unless it could be explicit in each xhr call, ie xhr({uri...}, waitForAuth=True)
13:41:51 <yoshuawuyts> timwis: oh yeah, that could work

[okdistribute]

dont know why this is in here

[okdistribute]

It looks like we are going to move off of auth0 and use township instead. We probably can use some of this but I think it might be better to start fresh with a new PR considering we will be running our own auth service. Will investigate