Set up alternative authentication for when github OAuth is 'down'

[Cleop]

As a gh-backup user I want to be able to authenticate myself without having to rely on github Oauth running So that I have secure access to my github data even when github is having technical difficulties.

• [ ] Store user's email addresses in the db
• [ ] Recognise when github OAuth is not working and give user option to authenticate by email
• [ ] Send user an email with a login link, when user clicks on the link they are logged in
• [ ] Store a cookie so that the user is authenticated until they log out

---

Original Question: Do we have to use github auth to authorise access to backed up data? If yes, how do we allow people to access their data when github is down if we can't authenticate them? If github is down will their authorisation mechanism also be?

Answer: When someone authenticates when github is up as usual then we will record their email address. Then on an occasion when github is offline we will allow them authenticate using our record of their email. We will send them a one time login link to their email. We will also add a cookie to keep them logged in until they log out.

[nelsonic]

@Cleop thank you for opening this issue/question. Let me answer your questions in order:

• [x] Yes we will be using GitHub OAuth
  • [x] When the person authenticates we will ask them for their Email address: https://developer.github.com/v3/users/emails
• [x] If GitHub is "down" we will allow them to authenticate using their email address.
  • [x] This will be achieved by emailing a one-time-login-link.
  • [x] Once logged-in the cookie on their computer will keep them logged in until they log-out

We do not need to build this functionality until after MVP is launched.