Module web 

Signing in to this server: its own accounts (a username and a password), and, with ESPORTS_LOGIN, “Sign in with the host site” (esports-lab). Both end in this server’s session cookie, which the OAuth consent page and the Account page (API tokens) use.

The host site. It shares a secret with this server (ESPORTS_SECRET) and uses it two ways:

• Signing in: GET /auth/esports sends the browser to the site’s /chess/sso?return=…&nonce=…; the site sends it back to /auth/esports/back?a=… with a signed statement of who is signed in there (sign: base64url(json).base64url(HMAC-SHA256), the JSON {sub, name, email, role, roles, nonce, exp}).
• Its server asks for a token for one of its players: POST /api/esports/token with Authorization: Bearer <secret> and the same fields as a form (plus scopes, days, label).

Either way the site’s player is linked to a player here by esports_id (made on first use, with a chess account named after them), so the same person is the same chess player whichever way they come in.

Structs

SitePlayer

A player of the host site, as it describes them.

Functions

account

GET /account.

allowed

The scopes a player may give a token (staff-only ones aside).

esports_back

GET /auth/esports/back?a=…: back from the site, signed in there.

esports_link

POST /api/esports/link (bearer the secret; form sub, username): a manager on the site says the account username here is their player sub’s, made before they signed in with the site. The site player’s link moves to it (an account it was linked to before stays, unlinked, with its games). Refused (409) when that account is another site player’s. An empty username unlinks. Answers {"username"}.

esports_players

GET /api/esports/players (bearer the secret): the site’s players linked here, {"players": [{"sub", "username"}]}, so the site can tell whose games the feed shows.

esports_revoke

POST /api/esports/revoke (bearer the secret; form label, and optionally sub): revoke the tokens of that name the site asked for (all its players’, or one’s). Answers how many.

esports_start

GET /auth/esports: off to the site to sign in.

esports_token

POST /api/esports/token: the site’s server asks for a token for one of its players (who gets linked, and a chess account, on first use).

hmac

HMAC-SHA256 (RFC 2104).

issue

Make a token; returns it (shown once) and when it expires.

issue_for

Make a token lasting life.

link

The player here linked to the site’s, made on first use (and kept up to date: email and roles). Returns the player’s id and chess username.

login

POST /login: a username (or email) and password.

login_page

GET /login.

logout

POST /logout.

new_token

POST /account/tokens.

revoke_token

POST /account/tokens/revoke.

sign

A signed statement: base64url(json).base64url(hmac).

signup

POST /signup: a username, a password and (optionally) an email.

signup_page

GET /signup.

verify

The statement, if its signature is right and it hasn’t expired.