mozilla/login.webmaker.org — pull request #53 by Pomax (2013-05-13 23:01:59+00:00)
Title: Newsso

Alright, here we go. I rewrote things so that there's only one client app - mostly because I don't know how to make the Procfile run two instances under --dev mode on different ports. If this is possible, best way to test, rather than building two `app` instances in the code. Also, this uses the new persona system (client side) as well as stubs for the webmaker-loginapi node wrapper (server side at the consumer app). The flow is now:

- user logs in with persona
- persona okays it
- consumer app (client side) calls its own /persona/verify to effect server-side auth as well
- auth passes -> req.session.email is set locally for the consumer app.
- consumer app (client side) then asks the webmaker SSO ui code to check whether this is a new, or known maker.

[EXTRA STEPS FOR NEW MAKER]
- sleak UI slides in to get the user to come up with a webmaker subdomain. they fill it in, save, etc, flow returns to the SSO ui code where this user is now a known maker

- the SSO ui code then calls the consumer app's /user/personaEmail so that the consumer app can (server side) obtain that user's display name and set it as part of the session cookie using the webmaker-loginapi, rather than trusting the client to send a legal display name.

At this would point we *should* have a fully authenticated user, and the locally set cookie can be used for everything.