cs198/codepuppy — pull request #70 by osdiab (2014-03-16 05:38:54+00:00)
Title: Feat login integrate

Please confirm this is good. Closes #11

# Test plan

* Evaluate if this is a secure scheme.
* Evaluate if I implemented it properly.
* Check if code is readable
* See if user experience is smooth on your side.

## Scheme

1. Go to codepuppy website.
2. Token is generated and stored in database.
3. Request gets sent to WebAuth machine, containing a) The generated token, b) the URL for the WebAuth provider to redirect to to complete the authentication process, and c) the current URL to forward to after authentication.
4. User authenticates.
5. If successful authentication, the generated token gets returned (exactly the same as before) along with an `hmac` hash for verification, and user information like `user_system_id`.
6. Send that data to the API's `/sessions/verify` endpoint, recompute the hmac to ensure that the hmac sent is legitimate (enforced by a shared secret)
7. If successful, mark the generated token as verified and log the user in.

### Notes
* Verification must happen within 20 minutes of token generation.
* Verified tokens remain usable for a month.
* Token is stored in cookies and passed around via headers, automatically added to `$http` requests by Angular.

## TODO

* Do not store the hmac key in the codebase (purge)
* Create new person when person is not found (registration is seamless)
* Only add authentication tokens for API requests, not all `$http` requests.