auth wip dont merge

[steveklabnik]

goes with artisan-tattoo/assistant-frontend#17

[shamanime]

My API uses koa, so I use koa-cors, might be something like this:

app.use('*', cors({
  origin: '*',
  allowedHeaders: ['Authorization', 'Content-Type'],
  methods: ['PUT', 'POST', 'PATCH', 'DELETE', 'GET', 'HEAD']
}));

[steveklabnik]

still yields

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://localhost:8080/sessions. This can be fixed by moving the resource to the same domain or enabling CORS.

for me :/

[tdantas]

@steveklabnik let's create a endpoint just to issue a brand new JWT token to the frontend.

var JWT = require('jsonwebtoken'); //  npm install jsonwebtoken --save
app.post('/signup', function(request, response) {
   var token = JWT.sign({ YOUR CLAIMS HERE }, SECRET );
   response.json({ token: token });
});

[tdantas]

@steveklabnik I will fork the api project and try to help you !
give me time ( 20 - 30 min ) to setup and make it works on my machine.

[steveklabnik]

ahh thanks! <3 Let me push this commit up with what you told me about

[tdantas]

great. let me know if work or not !

I don't know what the ember is expecting as response.
{ token: token } ?

[steveklabnik]

it's not entirely clear to me either to be honest :/ I'm just trying to do the absolute simplest possible thing to make auth work between the two

i'm gonna go get some coffee, but maybe ping me on irc too? and no worries if you just give up here

[tdantas]

I will setup my machine and ping you when I figure it out.

[tdantas]

@steveklabnik
this line says that every route after me must be authenticated.
so the signup endpoint
will never be reached.

let's change the orders between signup and passport

[tdantas]

@steveklabnik
just fixed using this gist ( https://gist.github.com/tdantas/b51ccb74b4aa9475a993 ) and the result
https://cloudup.com/c955lI2hF8z

[steveklabnik]

ahhh awesome thank you! I will try to see if i can get ember to play nice now. that makes perfect sense ❤️ ❤️ ❤️ ❤️ ❤️

[tdantas]

👍 amazing @steveklabnik let me know if you need anything else ! <3

[tdantas]

Just pushed to my fork. 👍

[tdantas]

@steveklabnik jwtStrategy will validate the issuer and audience.
so , you must issue a new JWT token on 'signup' with the same issuer and audience.

On my fork, I just removed ( issuer and audience) to make it simpler. make sense ?