search

cubing / algdb

📚 Algorithm Database
http://algdb.net
GNU General Public License v3.0
22 stars 3 forks source link

User authentication through WCA #3

Closed coder13 closed 4 years ago

coder13 commented 4 years ago

We decided to use WCA authentication for our user system.

In order to accomplish this, we'll need a way to interact with the database via the server. We should keep in mind which scopes we use and how we use them. I had a user get curious why I asked for the email scope with letscube when I didn't need to at all.

saranshgrover commented 4 years ago

For this particular application, I don't see why we'd need anything more than public and email. Lets stick with that.

big213 commented 4 years ago

Relevant code for WCA auth is here: https://github.com/cubing/algdb/blob/main/backend/functions/src/services/auth/auth.service.ts#L67

Just need to generate an application id @saranshgrover what would be a good redirect_uri for local testing? Maybe localhost:3000/wca-redirect?

big213 commented 4 years ago

Also, when the user has successfully authenticated, they will get a bearer access token that expires in 7 days. What do you think about setting the expiration to 30 days instead?

saranshgrover commented 4 years ago

Relevant code for WCA auth is here: https://github.com/cubing/algdb/blob/main/backend/functions/src/services/auth/auth.service.ts#L67

Could you use staging.worldcubeassociation.org for development?

Just need to generate an application id @saranshgrover what would be a good redirect_uri for local testing? Maybe localhost:3000/wca-redirect?

Yeah wca-redirect works fine.

Also, when the user has successfully authenticated, they will get a bearer access token that expires in 7 days. What do you think about setting the expiration to 30 days instead?

This is fine by me, though it may be nice if we could implement a refresh_token mechanism or even sessions.

big213 commented 4 years ago

Also, when the user has successfully authenticated, they will get a bearer access token that expires in 7 days. What do you think about setting the expiration to 30 days instead?

This is fine by me, though it may be nice if we could implement a refresh_token mechanism or even sessions.

I always found the refresh_token to be kinda redundant because if you have a refresh_token, it is basically the same as having an access_token? Anyway, I implemented the WCA auth in 77d19219038698772f10361f24e778fdb2e33ddc

Feel free to re-open if this is still not considered finished.