class Capsium::Reactor::Authenticator

Request authentication and route authorization for the reactor (05x-authentication, ARCHITECTURE.md section 4b).

When the package’s authentication.json enables basicAuth, every route is challenged (401 + WWW-Authenticate) until valid htpasswd credentials arrive. When oauth2 is enabled, the login and callback endpoints run the authorization-code flow and establish a signed session cookie. Route-level accessControl is enforced after authentication: 401 when unauthenticated, 403 when the identity lacks a required role.

Constants

LOGIN_PATH

Attributes

authentication [R] Package::Authentication

deploy [R] Deploy

Public Class Methods

new (authentication, deploy:, package_path:, base_url: nil, state_file: nil)

(Package::Authentication authentication, deploy: Deploy deploy, package_path: String package_path, ?base_url: String? base_url, ?state_file: String? state_file) → void

Source

# File lib/capsium/reactor/authenticator.rb, line 22
def initialize(authentication, deploy:, package_path:, base_url: nil,
               state_file: nil)
  @authentication = authentication
  @deploy = deploy
  @package_path = package_path
  @base_url = base_url
  @state_file = state_file
  build_oauth2_flow if oauth2_enabled?
end

Public Instance Methods

authenticate (request)

(untyped request) → Hash[String, untyped]?

Source

# File lib/capsium/reactor/authenticator.rb, line 59
def authenticate(request)
  identity = @session&.identity_from(request)
  identity || authenticate_basic(request)
end

The identity for a request — from the session cookie or Basic credentials — or nil. An identity always carries “roles” (possibly empty).

authorize (identity, access_control)

(Hash[String, untyped]? identity, Hash[String, untyped]? access_control) → (:ok | :unauthenticated | :forbidden)

Source

# File lib/capsium/reactor/authenticator.rb, line 74
def authorize(identity, access_control)
  return :ok unless access_control
  return :unauthenticated if unauthenticated?(identity, access_control)
  return :forbidden unless roles_allowed?(identity, access_control["roles"])

  :ok
end

:ok, :unauthenticated or :forbidden for a route’s accessControl ({“roles”: […], “authenticationRequired”: bool}).

challenge (response)

(untyped response) → untyped

Source

# File lib/capsium/reactor/authenticator.rb, line 65
def challenge(response)
  response.status = 401
  response["Content-Type"] = "text/plain"
  response["WWW-Authenticate"] = %(Basic realm="#{realm}") if basic_enabled?
  response.body = "Unauthorized"
end

401, with a Basic challenge when basicAuth is enabled.

enabled? ()

() → bool

Source

# File lib/capsium/reactor/authenticator.rb, line 32
def enabled?
  @authentication.enabled?
end

endpoint? (path)

(String path) → bool

Source

# File lib/capsium/reactor/authenticator.rb, line 42
def endpoint?(path)
  endpoints.include?(path)
end

endpoints ()

() → Array[String]

Source

# File lib/capsium/reactor/authenticator.rb, line 38
def endpoints
  oauth2_enabled? ? [LOGIN_PATH, @authentication.oauth2.redirect_path] : []
end

The paths this authenticator answers itself (OAuth2 login and callback), mounted by the reactor.

serve_endpoint (request, response)

(untyped request, untyped response) → untyped

Source

# File lib/capsium/reactor/authenticator.rb, line 46
def serve_endpoint(request, response)
  if request.path == LOGIN_PATH
    response.status = 302
    response["Location"] = @oauth2_flow.authorization_url(request)
    response.body = "Redirecting to the identity provider"
  else
    handle_callback(request, response)
  end
end