hmn/public
bvisness 0210a0784b Add Discord login (#106)
This leverages our existing Discord OAuth implementation. Any users with a linked Discord account will be able to log in immediately. When logging in, we request the `email` scope in addition to `identity`, so existing users will be prompted one time to accept the new permissions. On subsequent logins, Discord will skip the prompt.

When linking your Discord account to an existing HMN account, we continue to only request the `identity` scope, so we do not receive the user's Discord email.

Both login and linking go through the same Discord OAuth callback. All flows through the callback try to achieve the same end goal: a logged-in HMN user with a linked Discord account.

Linking works the same as it ever has. Login, however, is different because we do not have a session ID to use as the OAuth state. To account for this, I have added a `pending_login` table that stores a secure unique ID and the eventual destination URL. These pending logins expire after 10 minutes. When we receive the OAuth callback, we look up the pending login by the OAuth `state` and immediately delete it. The destination URL will be used to redirect the user to the right place.

If we have a `discord_user` entry for the OAuth'd Discord user, we immediately log the user into the associated HMN account. This is the typical login case. If we do not have a `discord_user`, but there is exactly one HMN user with the same email address as the Discord user, we will link the two accounts and log into the HMN account.

(It is possible for multiple HMN accounts to have the same email, because we don't have a uniqueness constraint there. We fail the login in this case rather than link to the wrong account.)

Finally, if no associated HMN user exists, a new one will be created. It will use the Discord user's username, email, and avatar. This user will have no password, but they can set or reset a password through the usual flows.

Co-authored-by: Ben Visness <bvisness@gmail.com>
Reviewed-on: hmn/hmn#106
2023-05-06 19:38:50 +00:00
..
cities Add handmade cities banner v1 2023-03-24 17:38:24 -04:00
education Better edu home page 2022-10-27 00:20:59 -05:00
fonts/mohave Add jam page 2021-08-28 06:26:17 -05:00
hms Update conference page design / copy 2022-07-26 11:34:05 -05:00
js Remove discord link for showcase items when not relevant 2022-08-09 12:27:32 +03:00
roles Rework about page, finally 2022-12-14 17:49:08 -06:00
themes Update auth flows 2022-08-13 14:15:00 -05:00
visjam2023 Add jam recap (not yet shown off properly) 2023-04-21 23:11:32 -05:00
wheeljam2021 Add all jams index 2023-04-22 11:26:07 -05:00
wheeljam2022 Add all jams index 2023-04-22 11:26:07 -05:00
close.svg Showcase page 2021-06-22 20:08:05 +03:00
discord-login.svg Add Discord login (#106) 2023-05-06 19:38:50 +00:00
favicon-16x16.png Add favicons to jam pages 2022-06-18 13:09:45 -05:00
favicon-32x32.png Add favicons to jam pages 2022-06-18 13:09:45 -05:00
fishbowl-dark.css Add entrepereuship fishbowl (#99) 2022-10-03 20:30:03 +00:00
fishbowl-light.css Add entrepereuship fishbowl (#99) 2022-10-03 20:30:03 +00:00
go_wasm_exec.js Initial version of education content (#90) 2022-09-10 16:29:57 +00:00
icons.ttf Profile page and timeline items 2021-06-22 12:50:40 +03:00
logo.png Improve OpenGraph / favicons 2021-09-08 21:51:43 -05:00
mathjax.js Add mathjax 2021-07-04 15:31:51 -05:00
parsing.wasm Make articles responsive 2022-10-26 13:26:01 -05:00
style.css Add Discord login (#106) 2023-05-06 19:38:50 +00:00
waterline-dark.svg Don't do clever hue-rotating trick with waterline image 2022-06-12 08:39:44 -05:00
waterline-light.svg Don't do clever hue-rotating trick with waterline image 2022-06-12 08:39:44 -05:00