84 lines
4.4 KiB
C++
84 lines
4.4 KiB
C++
//! \addtogroup HTTPServer
|
||
//! \~\file pihttpserverbearerauth.h
|
||
//! \brief HTTP server with per-route HTTP Bearer authentication
|
||
//! \~english HTTP server with per-route HTTP Bearer authentication
|
||
//! \~russian HTTP-сервер с HTTP Bearer-аутентификацией по маршрутам
|
||
/*
|
||
PIP - Platform Independent Primitives
|
||
HTTP server with per-route HTTP Bearer authentication
|
||
Ivan Pelipenko peri4ko@yandex.ru
|
||
|
||
This program is free software: you can redistribute it and/or modify
|
||
it under the terms of the GNU Lesser General Public License as published by
|
||
the Free Software Foundation, either version 3 of the License, or
|
||
(at your option) any later version.
|
||
|
||
This program is distributed in the hope that it will be useful,
|
||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||
GNU Lesser General Public License for more details.
|
||
|
||
You should have received a copy of the GNU Lesser General Public License
|
||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||
*/
|
||
|
||
#ifndef PIHTTPSERVERBEARERAUTH_H
|
||
#define PIHTTPSERVERBEARERAUTH_H
|
||
|
||
#include "pihttpserverprotected.h"
|
||
|
||
//! \~\ingroup HTTPServer
|
||
//! \~\brief
|
||
//! \~english Protected HTTP server that checks the \c Authorization header with the Bearer scheme
|
||
//! and an external token validator.
|
||
//! \~russian Защищенный HTTP-сервер, проверяющий заголовок \c Authorization со схемой Bearer
|
||
//! и внешним валидатором токена.
|
||
class PIP_HTTP_SERVER_EXPORT PIHTTPServerBearerAuth: public PIHTTPServerProtected {
|
||
PIOBJECT_SUBCLASS(PIHTTPServerBearerAuth, PIHTTPServerProtected)
|
||
|
||
public:
|
||
//! \~english Creates a Bearer-auth server with the default realm.
|
||
//! \~russian Создает сервер Bearer-аутентификации с realm по умолчанию.
|
||
PIHTTPServerBearerAuth();
|
||
|
||
//! \~english Sets the token validator: receives the Bearer token of the request and
|
||
//! returns the \c AuthInfo of the request. The access is denied when the validator returns
|
||
//! an \c AuthInfo with \c authorized \c false.
|
||
//! \~russian Устанавливает валидатор токена: получает токен Bearer-аутентификации запроса
|
||
//! и возвращает \c AuthInfo запроса. Доступ запрещается, когда валидатор возвращает
|
||
//! \c AuthInfo с \c authorized \c false.
|
||
void setBearerAuthCallback(std::function<PIHTTP::AuthInfo(const PIString &)> c) { callback_auth = std::move(c); }
|
||
|
||
//! \~english Sets the realm used in the \c WWW-Authenticate challenge (default \c "Restricted").
|
||
//! \~russian Устанавливает realm, используемый в challenge \c WWW-Authenticate (по умолчанию \c "Restricted").
|
||
void setRealm(const PIString & r) { auth_realm = r; }
|
||
|
||
//! \~english Returns the realm used in the \c WWW-Authenticate challenge.
|
||
//! \~russian Возвращает realm, используемый в challenge \c WWW-Authenticate.
|
||
const PIString & realm() const { return auth_realm; }
|
||
|
||
//! \~english Returns whether a token validator is set.
|
||
//! \~russian Возвращает, установлен ли валидатор токена.
|
||
bool hasBearerAuthCallback() const { return static_cast<bool>(callback_auth); }
|
||
|
||
protected:
|
||
//! \~english Parses the Bearer-scheme \c Authorization header and resolves the user with the
|
||
//! token validator set by \a setBearerAuthCallback().
|
||
//! \~russian Разбирает заголовок \c Authorization со схемой Bearer и разрешает пользователя
|
||
//! валидатором токена, установленным \a setBearerAuthCallback().
|
||
PIHTTP::AuthInfo authenticate(const PIHTTP::MessageConst & request) override;
|
||
|
||
//! \~english Reply produced when \a authenticate() denies access:
|
||
//! \c 401 Unauthorized with a \c WWW-Authenticate header advertising the Bearer scheme.
|
||
//! \~russian Ответ, создаваемый при отказе \a authenticate():
|
||
//! \c 401 Unauthorized с заголовком \c WWW-Authenticate, объявляющим схему Bearer.
|
||
PIHTTP::MessageMutable accessDeniedReply(const PIHTTP::MessageConst & request) override;
|
||
|
||
private:
|
||
std::function<PIHTTP::AuthInfo(const PIString &)> callback_auth;
|
||
PIString auth_realm;
|
||
};
|
||
|
||
|
||
#endif
|