//! \addtogroup HTTPServer
//! \~\file pihttpserverbasicauth.h
//! \brief HTTP server with per-route HTTP Basic authentication
//! \~english HTTP server with per-route HTTP Basic authentication
//! \~russian HTTP-сервер с HTTP Basic-аутентификацией по маршрутам
/*
    PIP - Platform Independent Primitives
    HTTP server with per-route HTTP Basic authentication
    Ivan Pelipenko peri4ko@yandex.ru

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU Lesser General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU Lesser General Public License for more details.

    You should have received a copy of the GNU Lesser General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

#ifndef PIHTTPSERVERBASICAUTH_H
#define PIHTTPSERVERBASICAUTH_H

#include "pihttpserverprotected.h"

//! \~\ingroup HTTPServer
//! \~\brief
//! \~english Protected HTTP server that checks the \c Authorization header with the Basic scheme
//! and an external credential validator.
//! \~russian Защищенный HTTP-сервер, проверяющий заголовок \c Authorization со схемой Basic
//! и внешним валидатором учетных данных.
class PIP_HTTP_SERVER_EXPORT PIHTTPServerBasicAuth: public PIHTTPServerProtected {
	PIOBJECT_SUBCLASS(PIHTTPServerBasicAuth, PIHTTPServerProtected)

public:
	//! \~english Creates a Basic-auth server with the default realm.
	//! \~russian Создает сервер Basic-аутентификации с realm по умолчанию.
	PIHTTPServerBasicAuth();

	//! \~english Destroys the server.
	//! \~russian Удаляет сервер.
	virtual ~PIHTTPServerBasicAuth() = default;

	//! \~english Sets the credential validator: receives the parsed Basic-auth login and pass and
	//! returns the \c AuthInfo of the request. The access is denied when the validator returns
	//! an \c AuthInfo with \c authorized \c false.
	//! \~russian Устанавливает валидатор учетных данных: получает разобранного логин и пароль
	//! Basic-аутентификации и возвращает \c AuthInfo запроса. Доступ запрещается, когда валидатор
	//! возвращает \c AuthInfo с \c authorized \c false.
	void setBasicAuthCallback(std::function<PIHTTP::AuthInfo(const PIString &, const PIString &)> c) { callback_auth = std::move(c); }

	//! \~english Sets the realm used in the \c WWW-Authenticate challenge (default \c "Restricted").
	//! \~russian Устанавливает realm, используемый в challenge \c WWW-Authenticate (по умолчанию \c "Restricted").
	void setRealm(const PIString & r) { auth_realm = r; }

	//! \~english Returns the realm used in the \c WWW-Authenticate challenge.
	//! \~russian Возвращает realm, используемый в challenge \c WWW-Authenticate.
	const PIString & realm() const { return auth_realm; }

	//! \~english Returns whether a credential validator is set.
	//! \~russian Возвращает, установлен ли валидатор учетных данных.
	bool hasBasicAuthCallback() const { return static_cast<bool>(callback_auth); }

protected:
	//! \~english Parses the Basic-scheme \c Authorization header and resolves the user with the
	//! credential validator set by \a setBasicAuthCallback().
	//! \~russian Разбирает заголовок \c Authorization со схемой Basic и разрешает пользователя
	//! валидатором учетных данных, установленным \a setBasicAuthCallback().
	PIHTTP::AuthInfo authenticate(const PIHTTP::MessageConst & request) override;

	//! \~english Reply produced when \a authenticate() denies access:
	//! \c 401 Unauthorized with a \c WWW-Authenticate header advertising the Basic scheme.
	//! \~russian Ответ, создаваемый при отказе \a authenticate():
	//! \c 401 Unauthorized с заголовком \c WWW-Authenticate, объявляющим схему Basic.
	PIHTTP::MessageMutable accessDeniedReply(const PIHTTP::MessageConst & request) override;

private:
	std::function<PIHTTP::AuthInfo(const PIString &, const PIString &)> callback_auth;
	PIString auth_realm;
};


#endif