Access AuthedUser in Request

The tutorial I can find told me that define security property for contract, you can enable BearerAuthorization for your endpoint:

val http: HttpHandler = contract {
    renderer = OpenApi3(ApiInfo("my secure api", "v1.0", "API description"), Jackson)
    descriptionPath = "/api/swagger.json"
    routes += basicRoute
    security = BearerAuthSecurity({ bearer: String -> bearer.startsWith("123") })
}

but I find that BearerAuthSecurity accept a String -> Boolean, and so the authorization is only rely on the truth of the boolean. Seems there’s no way, like use a bearer: String -> E? or bearer: String -> Either[E, FailedOperation] to determine the authorization and let user access the E while defining HttpHandler (by it.authedUser: E?…? I’m not quite sure about the best design from your perspective). I think it’s a very useful feature because the authorization of http4s and Ktor seems done so.

---

BTW if the feature have been implemented in http4k, please ignore this… And if not, I think I can help implement this after the design is confirmed.

[Ray-Eldath]

Thanks!!! Works now.

So kind of you for the fast reply as well as the detailed explanation! Thanks again! 😆

[daviddenton]

Np 😃

You can set the security instance onto each individual endpoint or the API as a whole. Like so…

routes += "/ping" meta {
            summary = "ping"
            description = " ping endpoint"
            returning(OK to "The result")
        } bindContract GET to { Response(OK).body("pong") }

Setting the security on an individual endpoint also overrides the “contract level” security, so if you just want an open endpoint you set it to use an instance of NoSecurity to achieve this in that endpoint’s meta block