b4mboo/git-review — pull request #89 by xystushi (2014-03-12 12:02:16+00:00)
Title: W.I.P. - BitBucket OAuth configuration.

This is a first step to add support of BitBucket to git-review. According to Github [workflow](http://guides.github.com/overviews/flow/), this pull request serves as a starting point of discussion and proof-of-concept, and it's not meant to be merged (yet).

First of all, there are very few BitBucket Ruby clients that are still being maintained. [bitbucket_rest_api](https://github.com/vongrippen/bitbucket) is the most downloaded and was updated 4 months ago; however, it falls short of our expectation because a lot of functionalities (including pull request!) are not implemented. Therefore, we will have to rollout our own.

Secondly, BitBucket's authorization is different from Github's. I've been reading their API docs for quite a while, and I don't think it's possible to use access token for basic authentication like how we are doing with Octokit currently. Since it's a bad idea to store username and password in plain text, we will opt for a proper OAuth for BitBucket.

It's a three-step process and consists of 4 keys in total. Simply put, after login and password is supplied, it will get a consumer_token and consumer_secret from BitBucket. Then an authenticate_url will be generated and the user needs to visit the url on BitBucket to grant git-review access and enter the verification code. Finally, BitBucket will return an access_token and access_secret. Only these four keys will be stored in ~/.git_review.yml, and the above-mentioned process only happens once when git-review is first used.

Then we will be able to call BitBucket's REST APIs for pull requests, commits, comments, etc.