alanshaw/david-www — pull request #150 by cyranix (2014-08-26 03:45:22+00:00)
Title: Allow private repo access via GitHub OAuth and LevelDB sessions

Work to implement https://github.com/alanshaw/david-www/issues/44.

Changes of note:
* New modules `auth` and `github`
* New "Access Denied" error page
* Users can sign in with GitHub OAuth — requested scopes are `repo,user:email`
* Sessions, backed by LevelDB, store the requesting user's OAuth access token, GitHub name, and CSRF state token
* Access tokens are used by `profile` and `manifest` modules
* Deployment requires the following config properties: `config.github.oauth.id` and `config.github.oauth.secret` for GitHub OAuth flow; `config.github.token` for general authenticated requests (replaces username/password usage)

**TODO:**
- [ ] Associate each private repo with a nonce that gets appended as a query param on badges
- [ ] Disallow indexing of private repos in "recently" lists
- [ ] Use icon to signify private repos
- [ ] Make the "Sign in with GitHub" CTA look good and work from all pages

Other notes:
* Next logical step would be to make treatment of organization repos more intuitive.