//! \addtogroup HTTPServer
//! \~\file pihttpserverbearerauth.h
//! \brief HTTP server with per-route HTTP Bearer authentication
//! \~english HTTP server with per-route HTTP Bearer authentication
//! \~russian HTTP-сервер с HTTP Bearer-аутентификацией по маршрутам
/*
    PIP - Platform Independent Primitives
    HTTP server with per-route HTTP Bearer authentication
    Ivan Pelipenko peri4ko@yandex.ru

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU Lesser General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU Lesser General Public License for more details.

    You should have received a copy of the GNU Lesser General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

#ifndef PIHTTPSERVERBEARERAUTH_H
#define PIHTTPSERVERBEARERAUTH_H

#include "pihttpserverprotected.h"

//! \~\ingroup HTTPServer
//! \~\brief
//! \~english Protected HTTP server that checks the \c Authorization header with the Bearer scheme
//! and an external token validator.
//! \~russian Защищенный HTTP-сервер, проверяющий заголовок \c Authorization со схемой Bearer
//! и внешним валидатором токена.
class PIP_HTTP_SERVER_EXPORT PIHTTPServerBearerAuth: public PIHTTPServerProtected {
	PIOBJECT_SUBCLASS(PIHTTPServerBearerAuth, PIHTTPServerProtected)

public:
	//! \~english Creates a Bearer-auth server with the default realm.
	//! \~russian Создает сервер Bearer-аутентификации с realm по умолчанию.
	PIHTTPServerBearerAuth();

	//! \~english Sets the token validator: receives the Bearer token of the request and
	//! returns the \c AuthInfo of the request. The access is denied when the validator returns
	//! an \c AuthInfo with \c authorized \c false.
	//! \~russian Устанавливает валидатор токена: получает токен Bearer-аутентификации запроса
	//! и возвращает \c AuthInfo запроса. Доступ запрещается, когда валидатор возвращает
	//! \c AuthInfo с \c authorized \c false.
	void setBearerAuthCallback(std::function<PIHTTP::AuthInfo(const PIString &)> c) { callback_auth = std::move(c); }

	//! \~english Sets the realm used in the \c WWW-Authenticate challenge (default \c "Restricted").
	//! \~russian Устанавливает realm, используемый в challenge \c WWW-Authenticate (по умолчанию \c "Restricted").
	void setRealm(const PIString & r) { auth_realm = r; }

	//! \~english Returns the realm used in the \c WWW-Authenticate challenge.
	//! \~russian Возвращает realm, используемый в challenge \c WWW-Authenticate.
	const PIString & realm() const { return auth_realm; }

	//! \~english Returns whether a token validator is set.
	//! \~russian Возвращает, установлен ли валидатор токена.
	bool hasBearerAuthCallback() const { return static_cast<bool>(callback_auth); }

protected:
	//! \~english Parses the Bearer-scheme \c Authorization header and resolves the user with the
	//! token validator set by \a setBearerAuthCallback().
	//! \~russian Разбирает заголовок \c Authorization со схемой Bearer и разрешает пользователя
	//! валидатором токена, установленным \a setBearerAuthCallback().
	PIHTTP::AuthInfo authenticate(const PIHTTP::MessageConst & request) override;

	//! \~english Reply produced when \a authenticate() denies access:
	//! \c 401 Unauthorized with a \c WWW-Authenticate header advertising the Bearer scheme.
	//! \~russian Ответ, создаваемый при отказе \a authenticate():
	//! \c 401 Unauthorized с заголовком \c WWW-Authenticate, объявляющим схему Bearer.
	PIHTTP::MessageMutable accessDeniedReply(const PIHTTP::MessageConst & request) override;

private:
	std::function<PIHTTP::AuthInfo(const PIString &)> callback_auth;
	PIString auth_realm;
};


#endif