V2.0: oAuth (with future proofing)

[thatkookooguy]

oAuth (with future proofing)

FEATURE

---

We want to implement oAuth in version 2.0 of achievibit.

Basically, this is the functionality we want:

• User can login with GitHub | GitLab | BitBucket using nest+passport

  we can use passport strategies for GitHub, GitLab, & BitBucket
  more strategies can be found here

• User is stored to a separate table that holds authenticated users (which is different than users who got achievements but never logged in)
• User can login with multiple services at the same time. Identifier should be the email address which is unique (at least the primary AFAIK)

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[thatkookooguy]

We need the same permissions as used by Travis CI

This is basically it: https://docs.travis-ci.com/user/github-oauth-scopes/

Since we want something very similar: posting status on pull requests, and adding webhook

and this should also handle the token authentication header for all requests for specific user data with an @AuthGuard guard and pipe

[thatkookooguy]

issue #55 can be seen for references on older version

[thatkookooguy]

Some material:

• https://docs.nestjs.com/techniques/authentication
• https://github.com/bojidaryovchev/nest-angular/tree/master/src/server/modules
• https://aaronparecki.com/oauth-2-simplified/
• https://oauth.net/2/
• https://auth0.com/docs/security/store-tokens

Some specific info:

We need a new table in our DB to handle authenticated users (which is not the same as regular users). This will include a method attribute which will be an array of attached methods (github, gitlab, or bitbucket) where the first one is the default one (or a string?). Besides that, each authUser will also contain the provider data:

import { Schema } from 'mongoose';

export const UserSchema: Schema = new Schema({
  method: {
    type: String,
    enum: ['github', 'gitlab', 'bitbucket'],
    required: true
  },
  roles: [String],
  github: {
    id: String,
    email: String,
    displayName: String,
    // ...
  },
  gitlab: {
    id: String,
    email: String,
    // ...
  },
  bitbucket: {
    id: String,
    username: String,
    displayName: String,
    // ...
  }
});

And we need to read the attached data to understand where to put the token from the oauth provider. achievibit actually needs that token for fetching extra PR data (which should happen with the user's access token)