alphagov/trade-tariff-admin — pull request #1 by sauliusg (2013-08-09 12:10:09+00:00)
Title: Api data exchange

This change is for https://www.pivotaltracker.com/story/show/47984981 and https://www.pivotaltracker.com/story/show/52900709

At first iteration we made Tariff's admin app share the database with the backend and that caused to much issues. So this is a refactoring that uses write API on the backend.

One concern is authentication and authorization. At the moment admin app utilizes gds-sso strategy (https://github.com/alphagov/gds-sso/blob/master/lib/gds-sso/warden_config.rb#L36) for user authentication. Admin app communicates with the backend using gds_sso_api_access strategy (https://github.com/alphagov/gds-sso/blob/master/lib/gds-sso/warden_config.rb#L137) meaning http basic auth. This allows no user level authorization on backend API endpoints. The alternative would be to use gds_bearer_token strategy(https://github.com/alphagov/gds-sso/blob/master/lib/gds-sso/warden_config.rb#L61) but in this case both Admin app and the backend should have the same OAuth client IDs and secrets, i.e. pretend to be a one app. This is because access token is issued per app and per user. Thoughts?

Environment variables that need to be set for this to work:

```ruby
TRADE_TARIFF_USER= '' # user for HTTP basic auth to the backend
TRADE_TARIFF_PASSWORD= '' # password for HTTP basic auth to the backend
TARIFF_ADMIN_OAUTH_ID= '' # has to be generated using signonotron
TARIFF_ADMIN_OAUTH_SECRET= '' # has to be generated using signonotron
```

We'll also need a user that can access admin app. Also has to be created using signonotron.