RejectedSoftware Forums

Sign up

Rest Interface with Authentication

I've been reading some threads here, but I can't really get the grips on whether it's possible and if so, how? I can't follow the answers as I'm a bit of a newcomer in this area.
Mentioned keywords seem to be: @before and Session.

I'd like to serve a serveRestJSClient with UserMan authentication.

I have it working so far as to authenticate the first "layer".
GET /api/Name works. But accessing GET /api/items/me will hang up the application and clot the port.

import userman.api:UserManAPI;
UserManAPI m_api;

@requiresAuth
class API : IAPI
{
    this(UserManAPI api) { m_api = api; }

    // interface class has @anyAuth
    string getName() { return "my name"; }

    IItemAPI m_items;
    this() { m_items = new ItemAPI(); };
    Collection!IItemAPI items() { 
        return Collection!IItemAPI(m_items); }

    import vibe.web.web : noRoute;
    import userman.web: User;
    @noRoute
    User authenticate(HTTPServerRequest req, HTTPServerResponse res)
	{
    	import std.stdio;
        writeln("authenticating");
		return .authenticate(req, res, m_api, "../");
	}
}

class ItemAPI : IItemAPI {
    string getMe() { return "test this";}
}

shared static this() {
    auto router = new URLRouter;

    auto usettings = new UserManSettings;
	usettings.requireAccountValidation = false;
	usettings.databaseURL = "file://./testdb/";
    auto uctrl = createUserManController(usettings);
    UserManAPI uapi = createLocalUserManAPI(uctrl);

    auto restsettings = new RestInterfaceSettings;
	restsettings.baseURL = URL("http://127.0.0.1:8080/api/");
    router.get("/js/api.js", 
        serveRestJSClient!IAPI(restsettings));
	router.registerRestInterface(new API(uapi), restsettings);

    auto settings = new HTTPServerSettings;
    settings.port = 8080;
	settings.bindAddresses = ["::1", "127.0.0.1"];
	settings.sessionStore = new MemorySessionStore;
    listenHTTP(settings, router);
}

Any ideas and inputs are warmly welcome.

Re: Rest Interface with Authentication

Stupid me. Forgot creating the Collection when overloading the constructor.

Anyway, now GET /api/name requires login, but GET /api/items/me works without logging in : /.

Any way it's possible to also require login for the collections?

Re: Rest Interface with Authentication

Since I want access to /api/* only allowed by logged in users I'm now simply fetching the route with the URLRouter and call the Userman authenticate method. Appears to be working.

Re: Rest Interface with Authentication

Am 07.12.2016 um 09:07 schrieb Timoses:

Since I want access to /api/* only allowed by logged in users I'm now simply fetching the route with the URLRouter and call the Userman authenticate method. Appears to be working.

This used to be the standard way and is definitely a possibility if
nothing more specific is required. I'll try to upload an example using
the new vibe.web.auth module as soon as I get some time. The
documentation for that module is currently still lacking.