authorization with oauth, but ...

a) all users ?
b) only admin users ?
c) new tinyint field to check: api -> yes / no ?

any suggestions?

While using Github as the repo for the new backend, it might also be a great idea to use travis-ci.org for automated tests

ich würde folgende vorgehensweise vorschlagen, um sich per oauth zu authentifizieren.

• zwei neue felder in oxuser: OXAUTH (tinyint) und OXAUTHKEY (varchar)
• OXAUTHKEY = api-key
• OXAUTH = user darf api nutzen: ja/nein

mit dem vorhandenen apikey kann ein user dann an die api andocken.
wird bei einem request ein gültiger api-key gefunden (OXAUTH true) darf der user sich am REST anmelden,
bekommt einen session-token, welcher eine definierte zeit gültig ist und kann loslegen.

fragen:
a) alle damit einverstanden?
b) wollen wir die vorgänge loggen? (anmeldeversuch, ip, etc?)
c) wie lang soll der token gültig sein?

Joscha to english
I think we should do it in the following way for oAuth:

• Adding two new fields in oxuser: OXAUTH (tinyint) and OXAUTHKEY (varchar)
• OXAUTHKEY = api-key
• OXAUTH = user is able to use the api: yes/no

With the apikey the user could authentificate against the api. Is a valid key found, the session-token will be generated and set for a limited time.

questions:
a) anyone ack?
b) should we track these things (Loggins, IP,...)
c) how long should a token be valid?

Create help texts wich can be included into the GUI at several functions to explain what and how you can use this button, field or whatever - similar to the known tooltips/balloontips in the Oxid backend

We need a project readme for GitHub like any other good project has...
It should say the most important things about the project and probably should tell some background story.

Why not link to the wiki if a reader is wants to know more?