auth

Paddy 2015-05-11 Parent:3223a8e679db

166:c45b946abe78 Go to Latest

auth/doc.go

Implement a GetProfileHandler. Create a Handler that will allow us to return details about a Profile. Right now, you only get a single Profile at a time, which is problematic, because it will lead to N+1 requests. But we have no reason to retrieve anyone _else_'s Profile, so it's not like you need to be fetching any Profile other than your own. Also, this requires a Token issued for the Profile in question, which means you're limited to one Profile per request, anyways. Future avenues for exploration may be an admin Token granting access to many Profiles, the unspecified service flow for accessing the API, or simply accepting that name, join date, last active date, and ID are "public information".

History
paddy@57 1 /*
paddy@57 2 Package auth provides an authentication service for managing user accounts and an OAuth2 provider.
paddy@57 3
paddy@57 4 The service is an opinionated implementation of authentication using passphrases and the
paddy@57 5 code.secondbit.org/pass package to implement user credentials and accounts. Additionally, users
paddy@158 6 are permitted to login using any email address they have on record. Care is also taken to be able
paddy@158 7 to mitigate attacks that have already happened and plan ahead for the worst case scenarios.
paddy@57 8
paddy@57 9 An OAuth2 provider is also built-in and provided, complete with client registration and management,
paddy@57 10 as well as a specification-based set of handlers for managing the issuing of grants and tokens. Token
paddy@57 11 validiity may be asserted through an API, or a proxy service is provided for stripping auth-specific
paddy@57 12 information from requests and replacing it with a trusted header containing information about the user
paddy@57 13 and client that authorized the request.
paddy@57 14 */
paddy@57 15 package auth