Define and spec authentication needs

[leto]

Recently I learned that while the curation app will have Github oauth tokens, the main opentree app uses Janrain.

More specifications are needed around how those will tie into the OTOL API

[jimallman]

Yes, this reflects the level of involvement / commitment of study curators vs. "drive-by" commenters. In the tree-browsing app, comments are stored in web2py, so they don't need Github access and won't touch the API.

Now, since we're assuming comments on a study will be stored in annotations in the Nexson, this does raise some tricky questions. Adding annotations means editing the file, which seems like more permission that a commenter/reviewer should have...

Sounds like a topic for the larger group. @jar398 , @kcranston ?

[kcranston]

Couple of thoughts: 1. We don't know yet how people will use the comment system on the opentree all (i.e. what sorts of things they will want to communicate); 2. I anticipate comments on the opentree app will largely be about the synthetic tree rather than an individual study, so they most likely won't be appropriate for study-level annotations; 3. I agree that enforcing github accounts in order to leave comments is probably overkill, although we do want some sort of authentication.

[leto]

We currently use Github oauth tokens for authentication, so closing