http4s/rho

Get rid of unsafe function in AuthedContext

Opened this issue · 0 comments

chuwy commented

AuthedContext.getAuth throws an exception when underlying AuthMiddleware returns None (or if middleware was not applied). Was initially raised here.

Here's how I first time stumbled upon this.

  1. I wanted to have a route /entities without authorization required (but instead behavior would be slightly different when user is not anonymous)
  2. My authorization logic was: request.headers.get("apikey").flatMap(db.getPermissionById), so whenever apikey was not present in DB or request - AuthMiddleware returned None
  3. Whenever AuthMiddleware returned None - I got NoSuchElementException in getAuth

I guess my design goals in 1st and 2nd points were slightly invalid and I got fixed this by changing authorization logic to always return something, e.g. Anonymous even when no apikey is available and using url >>> Auth.auth(), but it made my endpoint to officially require authorization.

  1. If design of AuthMiddleware is to never return None - we need to remove AuthedContext.getAuth entirely and use only >>> Auth.auth()
  2. If it is okay to return None for "anonymous users" - we need to make it return Option[AuthInfo] (this is what I did in #253)
  3. Somehow make it impossible to call authentication method without AuthMiddleware being applied (I guess this is a long-term goal of this ticket)