TrackYourself/track-yourself — pull request #30 by aisapatino (2014-06-22 18:10:03+00:00)
Title: Auth refactor

I did a refactor of auth, moving the rendering and auth-checking into our angular app. Things should be working. I did a few manual tests and all the current tests are passing.

#### Reasoning for the refactor

* Partially motivated by getting totally stuck trying to get protractor tests running
because of needing to simulate a login that has no front-end component. I.e. this
should make front-end testing easier.
* I think it simplifies our code structure by making things consistent - our
backend is basically an api, and all the rendering and user interaction is
done in angular
* Urls that the user sees will be consistent (all angular-style urls instead
of a mix)
* We don't need the `/app` prefix for angular urls
* We can easily display error messages when attempting to login or register
without reloading the page (angular makes the call asynchronously and
automatically updates with an error message when it gets a response)
* Static assets (css, images, subtemplates) no longer require auth to access,
so we can share them among public and user-only pages.

### Setup - backend

* Our express server only serves static files.
* The auth setup is modified slightly:
* backend login and register routes now send a response with a status and a
message (which is then parsed by our angular app), rather than doing a redirect
* The message is obtained from the passport strategy. When returning
`done(err, user)` you can include a third argument: `{message: ''}`
which we can use to pass an error message on for the user to see.

### Setup - angular

* Auth module has login and register controllers, which:
* Render the forms
* On submit, use `$http` to post to the backend auth url
* When the response is received, they display an error message on the page if
applicable, or redirect to `#dashboard` (placeholder page) if successful
* Logout controller sends `$http` to backend to log out, sets `$rootScope.currentUser` to null and
redirects to public index page
* Auth module adds an interceptor to `$httpProvider.interceptors` which does two things:
* When making a request, checks whether we logged in already and whether it's a public page.
If needed, redirects to login page
* When a response is received from server, checks for 401 status and redirects to login

### To do
* Write tests yet for the front-end auth module
* Get some protractor tests running
* I haven't read over the code super-thoroughly so it may be a bit messy in places, I had to do
a lot of experimenting to get things working. Feel free to comment if something looks off.