{"action":"created","issue":{"url":"https://api.github.com/repos/begriffs/postgrest/issues/260","labels_url":"https://api.github.com/repos/begriffs/postgrest/issues/260/labels{/name}","comments_url":"https://api.github.com/repos/begriffs/postgrest/issues/260/comments","events_url":"https://api.github.com/repos/begriffs/postgrest/issues/260/events","html_url":"https://github.com/begriffs/postgrest/issues/260","id":100188577,"number":260,"title":"Full user/login management","user":{"login":"begriffs","id":911911,"avatar_url":"https://avatars.githubusercontent.com/u/911911?v=3","gravatar_id":"","url":"https://api.github.com/users/begriffs","html_url":"https://github.com/begriffs","followers_url":"https://api.github.com/users/begriffs/followers","following_url":"https://api.github.com/users/begriffs/following{/other_user}","gists_url":"https://api.github.com/users/begriffs/gists{/gist_id}","starred_url":"https://api.github.com/users/begriffs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/begriffs/subscriptions","organizations_url":"https://api.github.com/users/begriffs/orgs","repos_url":"https://api.github.com/users/begriffs/repos","events_url":"https://api.github.com/users/begriffs/events{/privacy}","received_events_url":"https://api.github.com/users/begriffs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-08-10T23:07:25Z","updated_at":"2015-09-04T16:07:44Z","closed_at":null,"body":"Also we should probably think through all the things we want to be able to do for auth. Get a nice thorough list up front and then make issues for each item. The auth implemented thus far was just a proof of concept and needs to be improved for real use.\r\n\r\nHere's what I'm imagining so far:\r\n- Sign up as an anonymous user if permitted by the server\r\n- Create user account for another person as an admin\r\n  - Enforce password reset on next login\r\n- Reset your own password (#205)\r\n  - Either we need to do email handling or we investigate passwordless forms of authentication\r\n- View your own user information (issue #259)\r\n- View other people's information if you're an admin and the server supports it\r\n- Be unable to see other people's information if you're an ordinary user\r\n- Delete your own account (if permitted by foreign keys in other tables)\r\n- Granting (partial) access to 3rd parties (#196)\r\n\r\nPlease reply with your ideas."},"comment":{"url":"https://api.github.com/repos/begriffs/postgrest/issues/comments/137778566","html_url":"https://github.com/begriffs/postgrest/issues/260#issuecomment-137778566","issue_url":"https://api.github.com/repos/begriffs/postgrest/issues/260","id":137778566,"user":{"login":"diogob","id":20662,"avatar_url":"https://avatars.githubusercontent.com/u/20662?v=3","gravatar_id":"","url":"https://api.github.com/users/diogob","html_url":"https://github.com/diogob","followers_url":"https://api.github.com/users/diogob/followers","following_url":"https://api.github.com/users/diogob/following{/other_user}","gists_url":"https://api.github.com/users/diogob/gists{/gist_id}","starred_url":"https://api.github.com/users/diogob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diogob/subscriptions","organizations_url":"https://api.github.com/users/diogob/orgs","repos_url":"https://api.github.com/users/diogob/repos","events_url":"https://api.github.com/users/diogob/events{/privacy}","received_events_url":"https://api.github.com/users/diogob/received_events","type":"User","site_admin":false},"created_at":"2015-09-04T16:07:44Z","updated_at":"2015-09-04T16:07:44Z","body":"The problem with email handling is that the lines between an API server and an application server start to blur, and we open a door for an entire new universe of bugs and QOS issues. Maybe this is better left to an application layer and keep only the functionality of resetting the password in PostgREST.\r\n\r\nI could say the same about ```Enforce password reset on next login```, but in this case is not a clear cut decision."}}