cangevine/STEAMnet — pull request #62 by maxluzuriaga (2013-07-14 01:21:20+00:00)
Title: OAuth Support for API

Added OAuth support to api. To do this I removed the Users create action of the API; now users are made only after authenticating with OAuth. I also removed the Users password attribute from the database, it's made entirely unnecessary by authenticating with OAuth.

How it should work in the Android app is this (when the application is launched):

1. Check to see if the user is logged in, by checking to see if a token has been saved to the device (I'll explain what I mean by token later on).
2. The app detects your Android device's "provider id," which is a code to be used down the road by the API for sending push notifications to devices. Use this in building the url for the next step:
3. A webview opens and point it to http://steamnet.herokuapp.com/auth?provider_id=something.
4. The user logs/signs in using any number of services, including Twitter, Facebook, Google, or GitHub, using a simple website I built on the rails app.
5. The webview redirects to http://steamnet.herokuapp.com/auth/[some service]/callback, and in the HTML displays an "Access token." Right now it's in a simple paragraph tag for clarity, but in the future it should be hidden to the user.
6. At this point the Android app kicks in and detects that the webview is on the callback screen. It then parses the webview HTMl using something like: http://lexandera.com/2009/01/extracting-html-from-a-webview/ and saves the Access token somewhere on the device.
7. It closes the webview, and then uses the token for every request, by adding it as a simple attribute: "token." This allows the api to both ensure the request is coming from the android app, and allows it to detect which user is making the request.

This probably doesn't make much sense now, but I hope to explain it in more detail on monday, to make sure the android team knows exactly how to implement this. I haven't flipped the switch to require token authentication yet, so the existing ?username=... authentication should still work fine. Once the Android side has been successfully synchronized, which should be relatively painless, then I'll make the API require tokens.