{"action":"created","issue":{"url":"https://api.github.com/repos/vilnius/tvarkau-vilniu/issues/4","labels_url":"https://api.github.com/repos/vilnius/tvarkau-vilniu/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/vilnius/tvarkau-vilniu/issues/4/comments","events_url":"https://api.github.com/repos/vilnius/tvarkau-vilniu/issues/4/events","html_url":"https://github.com/vilnius/tvarkau-vilniu/issues/4","id":114536471,"number":4,"title":"User authentication","user":{"login":"tadaskay","id":4745368,"avatar_url":"https://avatars.githubusercontent.com/u/4745368?v=3","gravatar_id":"","url":"https://api.github.com/users/tadaskay","html_url":"https://github.com/tadaskay","followers_url":"https://api.github.com/users/tadaskay/followers","following_url":"https://api.github.com/users/tadaskay/following{/other_user}","gists_url":"https://api.github.com/users/tadaskay/gists{/gist_id}","starred_url":"https://api.github.com/users/tadaskay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tadaskay/subscriptions","organizations_url":"https://api.github.com/users/tadaskay/orgs","repos_url":"https://api.github.com/users/tadaskay/repos","events_url":"https://api.github.com/users/tadaskay/events{/privacy}","received_events_url":"https://api.github.com/users/tadaskay/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-11-02T06:47:56Z","updated_at":"2015-11-13T00:22:56Z","closed_at":null,"body":"I suggest token based auth, so that it doesn't require any unnecessary interaction from the user. Shortly speaking, phone sends a device id and gets a token.\r\nOptionally, token could be bound to e-mail, phone number so that user can change device, but maintain his identity within tvarkau-vilniu. Any thoughts?"},"comment":{"url":"https://api.github.com/repos/vilnius/tvarkau-vilniu/issues/comments/156278690","html_url":"https://github.com/vilnius/tvarkau-vilniu/issues/4#issuecomment-156278690","issue_url":"https://api.github.com/repos/vilnius/tvarkau-vilniu/issues/4","id":156278690,"user":{"login":"ViliusKraujutis","id":1859636,"avatar_url":"https://avatars.githubusercontent.com/u/1859636?v=3","gravatar_id":"","url":"https://api.github.com/users/ViliusKraujutis","html_url":"https://github.com/ViliusKraujutis","followers_url":"https://api.github.com/users/ViliusKraujutis/followers","following_url":"https://api.github.com/users/ViliusKraujutis/following{/other_user}","gists_url":"https://api.github.com/users/ViliusKraujutis/gists{/gist_id}","starred_url":"https://api.github.com/users/ViliusKraujutis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ViliusKraujutis/subscriptions","organizations_url":"https://api.github.com/users/ViliusKraujutis/orgs","repos_url":"https://api.github.com/users/ViliusKraujutis/repos","events_url":"https://api.github.com/users/ViliusKraujutis/events{/privacy}","received_events_url":"https://api.github.com/users/ViliusKraujutis/received_events","type":"User","site_admin":false},"created_at":"2015-11-13T00:22:56Z","updated_at":"2015-11-13T00:22:56Z","body":"Some discussion went on [chat on slack](https://codeforvilnius.slack.com/archives/tvarkau-vilniu/p1447365737000068).\r\n\r\nI see two perspectives here:\r\n* user,\r\n* technical.\r\nAnd both are compatible!\r\n\r\nFrom user perspective let's offer both anonymous and social logins (eg. for MVP just [Google+ as Renat draw it in prototype](https://www.flinto.com/p/a8b3d2df)).\r\n\r\nBut speaking from technical side (and it's compatible with user perspective), @tadaskay is right - best way is to use token based authentication.\r\n\r\nCreate token for each new app installation launched for the 1st time. And that would be used as an anonymous user.\r\n\r\nThen linking other authentication methods would allow us to build user profiles and report problems with increased trust level. Possible identity providers could include:\r\n* social networks\r\n  * Google+ (the one we'll use in our MVP)\r\n  * Facebook\r\n  * Twitter, etc\r\n* phone number\r\n* Vilnius.lt account\r\n* [bank link](https://www.swedbank.ee/business/cash/ecommerce/banklink?language=ENG).\r\n\r\n\r\n# Technical\r\nHere is some random ideas for devs. \r\n* So as @tadaskay suggested, let's use token based system.\r\n* Create an app token each time new app installation is launched for the 1st time.\r\n* Post device information to link app token with device information (actually that could be done with 1st call while getting app token), so we can protect from anonymous spammers as well as show anonymous users their own reports and keep them notifying about updates.\r\n* Authenticating with social networks for the 1st time creates new user account in our system.\r\n* Users can link multiple identity providers (social networks, email)\r\n* If social identity provider has name, email, phone, we prefill our user object with this information automatically.\r\n* Problems would have two fields device token and user_id. Latter is optional as logged in users still might want to report problems anonymously (as also [designed in our prototype](https://www.flinto.com/p/a8b3d2df))."}}