Set up user authentication with OAuth

This issue began as a discussion of the download/authorisation/authentication model of the application. Set up as a github app has been done and so now the next point to be addressed in this issue will be the authentication of users trying to access their github history/backup using OAuth.

As a gh-backup user
I want to be able to authenticate myself to access my github history
so that I know that unauthorised users will not have access to my private history.

• User is redirected to github authentication when trying to access a github-backup page
• User is redirected to the gh-backup page once they're authentication is successful

Notes:

OAuth Authentication

Once a user (where github-backup has been installed) wants to click on the button to see the history of a given comment they will be taken to the github-backup site and then they will have to authenticate with OAuth to prove that they are from the org. This step technically would not need to be performed in the case of public repos but given that it's essential for private repos, you only have to do it once and that in the future we may introduce writing access it seems like a good idea.

OAuth2 lets external applications request authorization to private details in a user's GitHub account

— Providing that its a Github App that has been installed by the org owner, will the github API provide a user access to all issues/comments regardless of if they're an author/ mentioned in them?

Github Apps

To see the github-back up button on each of your comments (which would link you to the github-backup site) we would use github apps.

To install a GitHub App, you must be an organization owner.

In the case of github-backup I envisage this being the case (so that in the long run the organisation can decide whether they wish to accept any costs associated with using the app as opposed to the individual). The other advantage of this is that: 'a GitHub App remains installed if the person who set it up leaves the organization', so this would be continuous as well.

GitHub Apps can request separate access to issues and pull requests without accessing the actual contents of the repository.