Experiment osm oauth2

[guyou]

Fixes #196

[rnorris]

Doesn't quite compile for me:

osm_api_client.c: In function ‘osm_api_client_finalize’:
osm_api_client.c:117:5: error: implicit declaration of function ‘g_unref’

Presumably should be g_object_unref()

Please resolve all compiler warnings. Mostly 'gchar*' in _OsmApiClientClass and function definitions versus 'const gchar*' as returned by librest functions.

Please ensure consistent indentation/mixed use of spaces and tabs in osm_api_client.c. Preferably just use spaces.

At some point will want to ensure optional compilation against librest (and thus disable OSM auth capability when not available) as it is not critical to general Viking operation.

For osm-oauth2-example.c - please move out of main src directory and put elsewhere - e.g. into tools/ or doc/dev/examples.

For osm-oauth2-example.c - change the Copyright statement appropriately.

For osm-oauth2-example.c - change the comment about 'flow for Gitlab' to something more appropriate.
Also consider mentioning this was derived / inspired / reworked from the gitlab example.

Presumably the commented keys in the osm-oauth2-example.c are registered to you?

For osm-oauth2-example.c the 'returns' when an environment variable isn't set should be EXIT_FAILURE not EXIT_SUCCESS as clearly the program has failed to do anything useful.

For osm-oauth2-example.c is better if some of the g_print() includes 'FUNCTION' in the output to distinguish between otherwise identical strings to help understand what is being called (and in what order).

In using osm-oauth2-example.c - it's unclear what getline() is for - i.e. explicitly tell the user to enter (or click on if terminal enabled) the Authorize URL generated above into a Webbrowser and confirm authorization access there - which then should respond with an Authorization code - which then should be input back into the CLI program.

It took me a while to work out what I was meant to do!
And then something seemed to happen ;)

So looks like the librest (pkce) / libsoup methods have potential.

How are we to proceed? (do you want me to build on your prototype? I probably won't have much time until end of September)

[guyou]

Thanks a lot for the review. I forgot to mention it is only a REALLY preliminary work, just to understand how to work with Oauth2. And I wanted to inform the Viking's community that this topic is under work in progress. But I have really few spare time currently.

Note: I don't plan to keep this Git branch. It is really for experimentation and sharing the work in progress.

After these iterations, I identified the following ideas.

The main process is:

1. compute a URL with a challenge (pkce)
2. open the URL in a browser
3. validate the authorisation: a code is generated and displayed in the browser
4. copy-paste this code the the client (the getline())
5. use this code as bearer (no need to renew on OSM)

For the user, I'm now able to imagine the following process:

1. a dialog with a "authenticate/renew" button and a text-field for the code
2. while clicking the button, Viking computes the URL and then opens the browser
3. once validated, the user has to copy-paste the generated code in the text-field
4. that's it.

Perhaps it would be better to use a "wizard" approach for this dialog:

1. first page with the button only
2. second page with a comment describing the procedure and the text field for the code

But I also have an other topic to investigate. As you can see, the example use librest and libsoup. Initially I understood this is mandatory due to a complex implementation hidden in librest/libsoup. But I found some examples to register with curl directly. So, I will try to recode without librest/libsoup.

Stay tuned!