Using Everyauth/Passport.js to authenticate with T

Question

I want to create an authentication system whereby the user can "sign up with Twitter", but all this effectively does is authenticate their Twitter account and prefills a registration form with their Twitter username. The user will then be asked to enter an email and password (or an alternative username).

Thus, upon registration, the user has authenticated access to their Twitter account, and the access token can be stored in a database. Later down the line I will use this to access the Twitter API.

Node modules such as everyauth and passport do a lot of the heavy lifting with OAuth, but they only appear to provide a findOrCreateUser method, which doesn't offer a lot of breathing space to do something like what I need to do – that is, redirect to a registration form before registering the user, or if a user is found, just logging them in as per usual.

Answer 1

Here's a quick sketch of a possible approach for this:

Note that Passport does not provide a findOrCreateUser method. All database management and record creation is defined by your application (as it should be), Passport simply provides facilities for authentication.

The key to this approach is to simply create an "incomplete" user record in your database, from the profile data given by twitter. Then, in your application's routes, you can check if the conditions you need are met. If not, redirect the user to a form where they are prompted to fill out missing details.

passport.use(new TwitterStrategy({
    consumerKey: TWITTER_CONSUMER_KEY,
    consumerSecret: TWITTER_CONSUMER_SECRET,
    callbackURL: "http://127.0.0.1:3000/auth/twitter/callback"
  },
  function(token, tokenSecret, profile, done) {
    // Create a user object in your database, using the profile data given by
    // Twitter.  It may not yet be a "complete" profile, but that will be handled
    // later.
    return done(null, user);
  }
));

app.get('/auth/twitter',
  passport.authenticate('twitter'));

app.get('/auth/twitter/callback', 
  passport.authenticate('twitter', { failureRedirect: '/login' }),
  function(req, res) {
    // The user has authenticated with Twitter.  Now check to see if the profile
    // is "complete".  If not, send them down a flow to fill out more details.
    if (req.user.isCompleteProfile()) {
      res.redirect('/home');
    } else {
      res.redirect('/complete-profile');
    }
  });

app.get('/complete-profile', function(req, res) {
  res.render('profile-form', { user: req.user });
});

app.post('/update-profile', function(req, res) {
  // Grab the missing information from the form and update the profile.
  res.redirect('/home');
});

Answer 2

Slight clarification. The test "if (req.user.isCompleteProfile())" could be:

if (req.user.isCompleteProfile)

ie, you create a field 'isCompleteProfile' when you are making the user record in the twitter step, and mark it true or false, depending on what you know of the user

or: it is a call to a function, thus

if (isCompleteProfile(req))

in this case, you have a separate function which tests the state of the user you have just created/modified, thus:

function isCompleteProfile(req) { if (typeof req.user.local.email === "undefined") return false; else return true; }

And, I'd echo the praise for Jared and this marvellous tutorial on authentication in passportjs.