Module web 

Signing in to this server: its own accounts (a username and a password), and, with ESPORTS_LOGIN, “Sign in with the host site” (esports-lab). Both end in this server’s session cookie, which the OAuth consent page and the Account page (API tokens) use.

The host site. It shares a secret with this server (ESPORTS_SECRET) and uses it two ways:

• Signing in: GET /auth/esports sends the browser to the site’s /chess/sso?return=…&nonce=…; the site sends it back to /auth/esports/back?a=… with a signed statement of who is signed in there (sign: base64url(json).base64url(HMAC-SHA256), the JSON {sub, name, email, role, roles, nonce, exp}).
• Its server asks for a token for one of its players: POST /api/esports/token with Authorization: Bearer <secret> and the same fields as a form (plus scopes, days, label).

Either way the site’s player is linked to a player here by esports_id (made on first use, with a chess account named after them), so the same person is the same chess player whichever way they come in.

Structs

NewAccount

SignIn

SignUp

SitePlayer

A player of the host site, as it describes them.

Functions

account

GET /account.

account_passkey_add

POST /account/passkeys: the new passkey.

account_passkey_options

POST /account/passkeys/options: a challenge to add a passkey.

account_passkey_remove

POST /account/passkeys/remove (form id). The last passkey of an account without a password stays.

account_password

POST /account/password (form password, and current: the password it replaces, unless a passkey confirmed it’s you): set or change it.

account_password_remove

POST /account/password/remove: passkeys only (with one, at least).

account_staff

POST /account/staff: the passkey check, for this session.

account_staff_options

POST /account/staff/options.

allowed

The scopes a player may give a token (staff-only ones aside).

api_staff

POST /api/account/passkey: the passkey check, for the token used.

api_staff_options

POST /api/account/passkey/options (a token): a challenge for the staff passkey check, made in an app.

esports_back

GET /auth/esports/back?a=…: back from the site, signed in there.

esports_link

POST /api/esports/link (bearer the secret; form sub, username): a manager on the site says the account username here is their player sub’s, made before they signed in with the site. The site player’s link moves to it (an account it was linked to before stays, unlinked, with its games). Refused (409) when that account is another site player’s. An empty username unlinks. Answers {"username"}.

esports_players

GET /api/esports/players (bearer the secret): the site’s players linked here, {"players": [{"sub", "username"}]}, so the site can tell whose games the feed shows.

esports_revoke

POST /api/esports/revoke (bearer the secret; form label, and optionally sub): revoke the tokens of that name the site asked for (all its players’, or one’s). Answers how many.

esports_start

GET /auth/esports: off to the site to sign in.

esports_token

POST /api/esports/token: the site’s server asks for a token for one of its players (who gets linked, and a chess account, on first use).

grant_listed

CHESS_ADMIN_EMAILS: this player becomes an admin if their confirmed email is listed and they have a passkey (an admin’s rights need one). Their email is as good as the host site’s sign-in that vouched for it.

hmac

HMAC-SHA256 (RFC 2104).

issue

Make a token; returns it (shown once) and when it expires.

issue_for

Make a token lasting life.

link

The player here linked to the site’s, made on first use (and kept up to date: the email, which the site vouches for). The site’s roles stay the site’s: roles here are this server’s own. Returns the player’s id and chess username.

login

POST /login: a username (or email) and password.

login_page

GET /login.

logout

POST /logout.

new_token

POST /account/tokens.

passkey_signin

POST /auth/passkey: signed in with a passkey (which is also the staff passkey check). Answers where to go next.

passkey_signin_options

POST /auth/passkey/options: a challenge to sign in with any of this server’s passkeys.

revoke_token

POST /account/tokens/revoke.

sign

A signed statement: base64url(json).base64url(hmac).

signup

POST /signup: a username, a password and (optionally) an email.

signup_page

GET /signup.

signup_passkey

POST /signup/passkey: the new account, with its passkey, signed in.

signup_passkey_options

POST /signup/passkey/options ({name, email}): a challenge to make an account with a passkey instead of a password.

verify

The statement, if its signature is right and it hasn’t expired.