First party login

[edpaget]

Hey all, this should handle user login and retrieving the OAuth token for sites on the *.zooniverse.org domain.

Basically the main thrust is that it allows a devise session cookie to be substituted for users credentials when making a request to the /oauth/token endpoint. So if a client is on a *.zooniverse.org domain, and a user is signed in using devise sending a request like...

{
   "grant_type": "password",
   "client_id": "asdk;fja;sdfqwklj;laskdfja;sdlfkj..."
}

...returns a fully scoped OAuth token for the site.

It also adds support for managing a devise session over JSON.

The only caveat is all of those endpoints need to use Rails's CSRF protection features to prevent a third-party site from ohijacking a users's session and getting free oauth tokens. Therefore the javascript client will need to look for the X-CSRF-Param and X-CSRF-Token headers and respond with a X-CSRF-Token header.

[camallen]

These provide all the route functionality for devise. We will need most of them (now we're offering HTML views for user control, etc) but routes like GET /users/cancel and DELETE /users are already implemented in the api user routes.

If we leave them as is then actual user delete functionality will exist and not the desired disable as we implemented via DELETE /api/users/. Previously I added just the routes we wanted to respond to, all others would raise a Routing Error.

[edpaget]

Cool, I will override those actions or remove those routes.

[edpaget]

@camallen does 61970fd resolve this for you?

[camallen]

remove the version string here

[camallen]

nice one @edpaget. @brian-c for logins on the client the workflow for both U&P and facebook would be:

1. Sign_in via /users/sign_in OR via the facebook omni auth callback to get a devise session.
2. Get a token via /oauth/tokens with the params

{
   "grant_type": "password",
   "client_id": "application_client_id_but_no_secret"
}

1. Use token to access the API routes with the custom versioned json application header.

[edpaget]

You can also GET /users/sign_in to get a json list of all possible auth methods and their URLs.