---
sidebar_label: 'Example: External kiosk sign-in'
sidebar_position: 3
---

# Example: External kiosk sign-in using a Code Interpreter

:::note
This section is currently under active development. Please check back later.
:::

This example shows how a Code Interpreter can be implemented to allow guests to sign in to accounts connected to external identities in kiosks by e.g. scanning an identifying QR code generated by an external source.

## Interpreting an identity code

```mermaid
sequenceDiagram
    participant kiosk as Kiosk
    participant fo as Future Ordering
    participant loy as Loyalty Integration &<br/>External Identity Provider

    note over kiosk : Guest scans a code 'identity-code'
    kiosk ->>+ fo : Interpret code 'identity-code'
    fo ->>+ loy : Interpret code 'identity-code'
    note over loy: [1] The code is validated and<br/>the user is identified as 'external123'<br />in the external identity provider

    loy ->>+ fo: [2] Authenticate external user 'external123'<br/>using signed ID token with personal data
    fo -->>- loy: Access token for user 'fo456',<br/>connected to external identity 'external123'

    loy ->>+ fo: [3] Generate authorization code for 'fo456'
    fo -->>- loy: Temporary authorization code 'xyz',<br />valid for user 'fo456'

    loy -->>- fo: [4] I own this code.<br/>Action: sign in user 'fo456' using temporary authorization code 'xyz'
    fo -->>- kiosk : Sign in 'fo456'<br />using temporary authorization code 'xyz'
    note over kiosk: The user 'fo456' is signed in to the kiosk
```

The diagram above overviews the 4 steps this example Code Interpreter does in order to sign in an external user:

<!-- 1. [Validate the identity code](#validating-the-identity-code) and extract the external identity. -->
1. Validate the identity code and extract the external identity.
2. [Authenticate the external identity](#authenticating-the-external-identity) in Future Ordering and request an access token.
3. [Request a temporary authorization code](#requesting-an-authorization-code--sign-in-actions) for the authenticated user using the access token.
4. Respond to the code interpretation request with a `sign-in` action containing the user's id and the generated authorization code.

<!-- ### Validating the identity code -->

### Authenticating the external identity

The Code Interpreter authenticates the user using the `backchannel_external_token` flow and receives an access token with the `fo:auth` scope.

:::info
See [authenticating external users without user interaction](./../../users/authenticating-external-users/overview.md) for more detailed information on this authentication flow.
:::

### Requesting an authorization code & `sign-in` actions

Once the external user has been authenticated and an access token issued, the Code Interpreter can use this access token to call the Future Ordering API on behalf of the user. Using the API, a user can request a temporary authorization code which another system within Future Ordering, e.g. a kiosk, may use to sign in as that user.

The Code Interpreter requests a temporary authorization code and includes it in a `sign-in` action response, signing in the user scanning the code.
A `show-modal-dialog` action with e.g. a "You are now signed in!" message may also be included. See [response actions](./building-code-interpreter.md#response-actions) for more information on available actions.

<!-- todo: se om statusCode verkligen är relevant -->
*Example Code Interpreter response with a `sign-in` action followed by a `show-modal-dialog` action shown to the user after they are signed in:*
```json
{
    "owner": true,
    "statusCode": "successful",
    "code": "some-identity-code",
    "actions": [
        {
            "type": "sign-in",
            "userId": "fo456",
            "authorizationCode": "xyz"
        },
        {
            "type": "show-modal-dialog",
            "title": {
                "value": "Welcome!"
            },
            "message": {
                "value": "You are now signed in."
            }
        }
    ]
}
```