planning messenger auth

[owen-d]

There are a few steps we need to implement.

• [ ] We specify an acocunt linking callback url, I'm thinking nix.com/.../link-fb-bot or smtn
  • fb bot will construct and direct us to a link like: https://www.example.com/v1/authorize?redirect_uri=CALLBACK_URL&account_linking_token=ACCOUNT_LINKING_TOKEN
• [ ] Assuming the user isn't logged in, newsite will redirect it to the signin page.
• [ ] After signup/signin, newsite will need to remember that it was supposed to link to fb bot, and hit that endpoint again
• [ ] Track-api endpoint will fetch the page scoped id via the following:

curl -X GET "https://graph.facebook.com/v2.6/me?access_token=PAGE_ACCESS_TOKEN \
      &fields=recipient \
      &account_linking_token=ACCOUNT_LINKING_TOKEN"

• [ ] track api will link the user account with the scoped id, generate an authorization code, and return it.
• [ ] newsite will be responsible for redirecting like the following:

https://www.facebook.com/messenger_platform/account_linking
      ?account_linking_token=ACCOUNT_LINKING_TOKEN
      &authorization_code=AUTHORIZATION_CODE

Note: we don't actually use the authorization code, but it's needed to signify to facebook that the op was successful. I'll be randomly generating them.

• [ ] messenger will pass the authorization_code from above to the account linking callback to messenger-node's account-linking callback mechanism, but we won't do anything with it.

  Extra notes/requirements:

• I need to implement a way to link accounts w/ fb_scoped ids. We could do this via extending the user schema, but it'll probably be done via reference, so we leave user states unchanged.
• We will need an experimental endpoint that authenticates via user id & then logs a food, which track-api will handle. It will require threescale credentials & the scoped_user_id, and either log a food (if a user is attached to that scoped id) or just return the nutrients.

[owen-d]

@Yurko-Fedoriv sound good?

[Yurko-Fedoriv]

I still don't get why do we need to go through facebook's account linking, but if it's the way, then ok.

[Yurko-Fedoriv]

also, you have full access to the database from the boot side... why do you need additional endpoint? just grab some user token from it and submit the food normally