Module web 

Signing in to this server: its own accounts (a username and a password), and, with ESPORTS_LOGIN, “Sign in with the host site” (esports-lab). Both end in this server’s session cookie, which the OAuth consent page and the Account page (API tokens) use.

The host site. It shares a secret with this server (ESPORTS_SECRET) and uses it two ways:

• Signing in: GET /auth/esports sends the browser to the site’s /chess/sso?return=…&nonce=…; the site sends it back to /auth/esports/back?a=… with a signed statement of who is signed in there (sign: base64url(json).base64url(HMAC-SHA256), the JSON {sub, name, email, role, roles, nonce, exp}).
• Its server asks for a token for one of its players: POST /api/esports/token with Authorization: Bearer <secret> and the same fields as a form (plus scopes, days, label).

Either way the site’s player is linked to a player here by esports_id (made on first use, with a chess account named after them), so the same person is the same chess player whichever way they come in.

Structs

SitePlayer

A player of the host site, as it describes them.

Functions

account

GET /account.

allowed

The scopes a player may give a token (staff-only ones aside).

esports_back

GET /auth/esports/back?a=…: back from the site, signed in there.

esports_players

GET /api/esports/players (bearer the secret): the site’s players linked here, {"players": [{"sub", "username"}]}, so the site can tell whose games the feed shows.

esports_revoke

POST /api/esports/revoke (bearer the secret; form label, and optionally sub): revoke the tokens of that name the site asked for (all its players’, or one’s). Answers how many.

esports_start

GET /auth/esports: off to the site to sign in.

esports_token

POST /api/esports/token: the site’s server asks for a token for one of its players (who gets linked, and a chess account, on first use).

hmac

HMAC-SHA256 (RFC 2104).

issue

Make a token; returns it (shown once) and when it expires.

issue_for

Make a token lasting life.

link

The player here linked to the site’s, made on first use (and kept up to date: email and roles). Returns the player’s id and chess username.

login

POST /login: a username (or email) and password.

login_page

GET /login.

logout

POST /logout.

new_token

POST /account/tokens.

revoke_token

POST /account/tokens/revoke.

sign

A signed statement: base64url(json).base64url(hmac).

signup

POST /signup: a username, a password and (optionally) an email.

signup_page

GET /signup.

verify

The statement, if its signature is right and it hasn’t expired.