Facebook Login.md

• user signs up with email and password:

  • if the email exists, validation error.
  • if the email is linked to a facebook account, they'll see the "merge?" box when they try to link later
  • if the email doesn't exist, create the account!
    • Username is auto-generated
    • we send a welcome! email
    • we send a verification email

• user decides to link a Facebook account:

  • when the user clicks on the "Link Facebook" link in profile, login with javascript SDK
    • if the login is unsuccessful or fails for some reason, show an error
    • if link is successful,
      • If ANOTHER USER has already registered that facebook account, offer to merge. If user declines, just cancel the operation. Else, merge users.
      • If another user exists with that email, prompt the user to merge accounts. If it already has another facebook account, this facebook account is going to win. If the user cancels, tell them that they can always merge from their profile.

• If Javascript Facebook authentication is successful:

  • send token -> server, exchange for long-lived token
  • Store the facebook UserID in the user object
  • populate current user's profile off of Facebook data (only profile data that's not set!)
  • Download current Facebook images for profile and background (if they're not set) to AWS

• If a user tries to unlink a Facebook account:

  • make sure that the user's password is set.
    • If so, just wipe the data
    • If not, tell them "Whoops!" and tell them they have to set a password first.

• User signs up with Facebook:

  • login call on SDK with email permissions
  • if the call is a failure, show error
  • if call is successful, check with server to see
    • if an account with that facebook user ID already exists, just go to profile: "you're already in!"
    • if an acct with the EMAIL exists, prompt a merge. (as above, note that this facebook will win)
    • else,
      • create a new account based on "If Javascript Facebook authentication is successful" above,
      • keep the password blank
      • send a welcome and verification email to the facebook email
      • set that email in the user's acct