RFC: An authentic authentication about vulcan-next HOT 3 OPEN

Regarding private pages, it needs #49 and #71 needs to progress a bit until we get a proper architecture.

from vulcan-next.

Regarding role management, we should probably keep Vulcan NPM as-is: simply include "guests" (or "anyone"), "members" and "admin" groups.
Then, instead of trying to add groups into Vulcan, we could make it possible to build a role based security system inside Vulcan Next instead.

from vulcan-next.

@Timi-Duban in the short run, we would need to add new endpoint to have the same features as described here in VulcanMeteor: https://github.com/VulcanJS/Vulcan/blob/devel/packages/vulcan-users/lib/server/mutations.js

In Vulcan Meteor, we rely on Meteor Accounts (see https://github.com/VulcanJS/Vulcan/blob/devel/packages/vulcan-users/lib/server/AuthPassword.js).

In Vulcan Next, we rely on passport, so lower level but more powerful library.
Also, currently, we don't use graphql for auth, but normal REST endpoint (see existing entry points for "logout", "login", and "signup") => we can keep doing that for now.

The most difficult part is handling e-mails, for user verification ,password change and so on. During developement, we should probably "fake" this part and just log the email in the server console. I'll take care of introducing more robust mailing system.

from vulcan-next.