About OAuth support

The OAuth support in Staticman is buggy and very limited. Although is had been there years, I can hardly find any site using this feature.

Currently the OAuth feature:

• is only used to retrieve the user properties such as name or email. (see Staticman.js::_checkAuth and Staticman.js::_applyGeneratedFields)
• has nothing to do with how Staticman access your repository.
• is limited to the same git service. You can’t authenticate with GitHub on site hosted on GitLab.
• doesn’t handle the redirection. It’s your responsibility redirecting guest to OAuth provider.
• failed when profile has no email available. (on GitHub you can leave it empty) (No related issue yet)

Can someone explain why and how is this feature added at then? What is the plan in future?

[eazydripz]

Thank you.

[alexwaibel]

This isn’t something we can pick up right away, but it’s definitely something to add to the backlog. I agree with your assessment that the git provider and the profile provider don’t need to be coupled.

I think in the end we could simplify this whole flow to one Staticman API call which is submitted by the site’s form. Redirects would handle the rest. We could move the auth info to somewhere optional in the entry request so one call contains all the info to auth and post content. This will require further thought to handle the following cases:

• A user submits two comments on the same blog. They should only have to log in once
  • Maybe here is a chance to use that encrypted access_token from the oauth request
• A user logs in without submitting anything.
  • This may be justification for keeping the separate auth endpoint
  • Supporting this isn’t necessarily the primary goal of staticman, but it would be cool to support

Thanks for all the initial work on this. OIDC looks like a pretty good fit.