how are we gonna handle authentication?

[EngineerRunner]

if we want to add uploading, leaving comments, changing profile picture, we need to be able to log somebody into scratch's api. but how will that integration work? we'd have to:

• assume it is always running locally and have the user input their username and password
• go along with the massive security holes (and ban from scratch) by having it hosted publicly and asking for scratch logins
• use a browser extension that the website communicates with to do the actions?
• or just not have any of that functionallity at all.

[redstone-dev]

I think that Scratch Auth is the obvious choice. The user_data array is for testing, we could use SQLite or MySQL when we get Snazzle into production.

[EngineerRunner]

but, even with ScratchAuth, we can't do social actions on behalf of the user like posting on the forums. that's what I meant.

[redstone-dev]

Oh, yeah, that's a problem. Hm...

[Darth-Ness]

For now, since servers are all locally hosted, it should be fine if someone put in there password and username like normal. That will become a problem once there's public server's though.

[NotFenixio]

What about summoning a Scratch login pop-up, and when the user logs in, extracting the sessionId cookie?

[redstone-dev]

That sounds a little shady. I don't want to do that.

[NotFenixio]

That sounds a little shady. I don't want to do that.

Yeah, I don't know what I was thinking.

[redstone-dev]

not feasible

[dynamixbot]

REOPEN DESCRIPTION (ISSUE IMPORTANT)

We can have the user enter their password and then authorise it by randomly generating a 256-bit random hash which they type into their profile's comments. Else, they can type it into a cloud project which gets accessed by Snazzle to verify and let through the user. The user's password can then be stored to allow future login.

[NotFenixio]

How does that give the user the "WeWontStealYourPassword™" feeling?

[dynamixbot]

How does that give the user the "WeWontStealYourPassword™" feeling?

Uhhhh maybe not enter your scratch password?