{"action":"opened","issue":{"url":"https://api.github.com/repos/wiredmonash/monash-ninja-api/issues/1","repository_url":"https://api.github.com/repos/wiredmonash/monash-ninja-api","labels_url":"https://api.github.com/repos/wiredmonash/monash-ninja-api/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/wiredmonash/monash-ninja-api/issues/1/comments","events_url":"https://api.github.com/repos/wiredmonash/monash-ninja-api/issues/1/events","html_url":"https://github.com/wiredmonash/monash-ninja-api/issues/1","id":176157508,"number":1,"title":"Google OAuth support","user":{"login":"hugomd","id":1646536,"avatar_url":"https://avatars.githubusercontent.com/u/1646536?v=3","gravatar_id":"","url":"https://api.github.com/users/hugomd","html_url":"https://github.com/hugomd","followers_url":"https://api.github.com/users/hugomd/followers","following_url":"https://api.github.com/users/hugomd/following{/other_user}","gists_url":"https://api.github.com/users/hugomd/gists{/gist_id}","starred_url":"https://api.github.com/users/hugomd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hugomd/subscriptions","organizations_url":"https://api.github.com/users/hugomd/orgs","repos_url":"https://api.github.com/users/hugomd/repos","events_url":"https://api.github.com/users/hugomd/events{/privacy}","received_events_url":"https://api.github.com/users/hugomd/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/wiredmonash/monash-ninja-api/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-10T04:51:51Z","updated_at":"2016-09-10T04:51:51Z","closed_at":null,"body":"## Reasoning\r\nCurrently, a user enters their student ID and Monash Ninja code. This allows them to abuse the system by claiming other codes using other student IDs, and potentially ruining it for everyone else. So, to remedy this, I propose requiring users to login with Google before entering in their student ID and code.\r\n\r\nHaving users would also let us add other components to the challenge, like an online game for instance, or allow users to be part of a 'special club' for finding a code.\r\n\r\nWe can  perform a look up using their email to find their student ID, although this will have to be done manually. In the meantime, it will be easiest to record student ID and code, _and_ have them login with Google beforehand.\r\n\r\n## Method\r\nUsing the [googleapis](https://www.npmjs.com/package/googleapis).\r\n\r\n1. Use One Time Code to request an access token from Google.\r\n2. Use Access Token to request user profile from Google.\r\n3. Create or login user given profile information.\r\n\r\nAuthentication should work as follows:\r\n```\r\n                                 ┌───┐\r\n                                 │ 1 │\r\n                                 └───┘\r\n    ┌────────────────┐                            ┌────────────────┐\r\n    │                │          Requests          │                │\r\n    │     Client     │ ──────────token───────────▶│     Google     │◀────────────┐\r\n    │                │                            │                │             │\r\n    └────────────────┘                            └────────────────┘             │\r\n             ▲                                             │                     │\r\n             │                                             │                     │\r\n             │                                             │                     │\r\n             │                          ┌───┐  Sends One Time Code (OTC)         │\r\n             │                          │ 2 │    via redirect URI for        Requests ┌───┐\r\n             │                          └───┘    accessing Google User         user   │ 3 │\r\n             │                                          profile              profile  └───┘\r\n             │                                             │                     │\r\n┌───┐   Redirects user to                                  │                     │\r\n│ 4 │   frontend, passing                                  │                     │\r\n└───┘ token in the process                                 ▼                     │\r\n             │                                    ┌────────────────┐             │\r\n             │                                    │                │             │\r\n             └────────────────────────────────────│      API       │─────────────┘\r\n                                                  │                │\r\n                                                  └────────────────┘\r\n```"}}
{"actor":{"display_login":"hugomd"}}