Authenticated user sessions w/backend

[ejhumphrey]

• [ ] user sign-up -> datastore
• [x] user login
• [x] authenticate audio/uploads
• [x] authenticate annotation/submits

[alastair]

How do you want to manage authentication? Do it ourselves, or pass off to oauth (facebook,google,github,twitter?)

Can any authenticated user submit audio and annotations or are groups/permissions required?

[ejhumphrey]

per this, I'm planning to use OAuth via other services. Google makes it wicked easy, so that's probably a fine place to start.

Can anyone submit audio? No, we'll restrict that to at least the dev group, and from there maybe even a few select individuals. This might be easiest by actually not having an audio/ingest endpoint, instead having machinery that must be properly credentialed locally.

Can anyone submit annotations? Yes, once logged in. If it comes to it, we can scrub data from bad actors, or lock them out of the system if / when identified.

[julian-urbano]

If we plan on implementing the credit system by which annotations give you points and system runs consume them, we should be able to link several user accounts together as part of an org account or something like that, so they can share credit.

[ejhumphrey]

A "credit system" is a good thing to be aware of / have on the roadmap, though I might argue against it for the first iteration.

Regardless, it'd be great if someone could document a proposal about how such a system would work, what problems it solves, and other such thoughts ... 😉

[dmcennis]

Love the credit system idea. It will help keep analysis costs in reach for PhD students and still keep the door open for those that would rather donate cash than provide free labor.

On Wed, Aug 31, 2016 at 11:57 AM Eric J. Humphrey notifications@github.com wrote:

A "credit system" is a good thing to be aware of / have on the roadmap, though I might argue against it for the first iteration.

Regardless, it'd be great if someone could document a proposal about how such a system would work, what problems it solves, and other such thoughts ... 😉

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/omec/bedevere/issues/9#issuecomment-243811103, or mute the thread https://github.com/notifications/unsubscribe-auth/AFItP15d5eaT5gYg57GlAgAexpkSp0JTks5qlaRbgaJpZM4Jvlr4 .

[ejhumphrey]

in the course of progress elsewhere, there are a few options to consider:

• AppEngine can enforce login around specific routes, which is shiny. However, I think this forces everyone to go through google? Not yet clear from the docs.
• Similarly, we can also hide specific routes behind admin credentials, which might help address the "who can upload audio" question. Again, same caveat as above.
• Alternatively, user logins can be punted to the server itself. For this, we can use the Python Users API from Google, which doesn't seem too gnarly ... or something like Flask-OAuth, which is both more flexible and complicated.

These bullets are ordered in increasing complexity, so it probably makes the most sense to work top-down until we find a solution that works.

[ejhumphrey]

0a8ef65 takes care of a big chunk of this, not far off from a PR

[ejhumphrey]

this is done as of #48