So before the Open Authoring GitHub Integration was a thing, I was working on a way to enable a client to edit his own site with TinaCMS. I wanted to show you folks the result.
I use GitLab OAuth for authentication and to check whether the GitLab User is a member of the project. With a private GitLab project, I have tight control of who can edit the site.
This is a prototype I extracted from that client project:
And here’s the backend to that project (I can add you as a member if you’re interested):
However, there’s a few caveats to this, of course. All of the commits are made with a single GitLab User, who authenticates via SSH on the server. Also at the moment, you’re logged out after every refresh.
And, most importantly, TinaCMS still renders, when you’re not logged in. So I also have a question:
Is there currently a way to prevent TinaCMS from rendering for non-authenticated users?
Any feedback, especially on the security of this approach, is very welcome.