[FEATURE REQUEST]get username from http basic auth and other types of auth

[tuhao1020]

https://github.com/iris-contrib/middleware/blob/master/casbin/casbin.go#L72

this line of code get username only by BasicAuth
In production environment, there will be other types of auth, such as session, token, jwt, OAuth...

[AlbinoGeek]

@tuhao1020 It's difficult to believe that iris would be aware of your specific setup of the database, among other things. It is not a framework like Meteor for example, which has a builtin session and user authentication to the point where it forces you to code the way their developer dictates.

That being said, if you are using mvc, you could make a Username field available using Dependency Injection.

Please see:

• _examples/dependency-injection/sessions/main.go
• _examples/dependency-injection/jwt/main.go

And more specifically:

• _examples/dependency-injection/context-register-dependency/main.go

[tuhao1020]

@AlbinoGeek Is it possible to provide a callback interface so that users can customize the method to get the user name, role or other informations

[kataras]

@tuhao1020 you mean in the builtin and iris-contrib middlewares? You can use the ctx.Values() wrap every auth middleware you use and set the proper values.

I believe this is not necessary as we don't have much of auth middlewares controlled by us. There are hundreds of go packages for that job, I think it's not possible and productive to find all of them and "export" their roles and username, it's like designing a whole new package without any realistic benefits (my opinion). However, if you give me a list of middlewares that you use and need that type of feature, I will see what I can do.

[tuhao1020]

@kataras considering that I use a simple string token encoded with Base64, and username can be decoded from it. (this is just an example to show you the usage) if I use this middleware, I need to copy all the code and rewrite the builtin function func (c *Casbin) Check(r *http.Request) bool and func Username(r *http.Request) string. Any other way to do this better?

[kataras]

OK @tuhao1020,

• The SetUsername function was added

Note that you could modify the username before too, using the ctx.Request().SetBasicAuth("username", "password")*

• The Check(*http.Request) bool method was replaced with Check(iris.Context) bool
• The Wrapper method was removed entirely, use Party#UseRouter(cm.ServeHTTP) instead

Further feedback is welcomed!

[tuhao1020]

@kataras
got an error:

github.com/iris-contrib/middleware/casbin: github.com/iris-contrib/middleware/casbin@v0.0.0-20201009155408-de61c68928c0: parsing go.mod: go.mod:7:2: require github.com/kataras/iris/v12: version "master" invalid: must be of the form v1.2.3

[kataras]

Wait, go get does not resolve the master by itself? Why go build does?

Anyway, it's fixed now, please try again.

[tuhao1020]

@kataras OK! it works.

[kataras]

@tuhao1020 I though of this yesterday and added a Context.Logout and a Context.SetLogoutFunc to "logout" from basicauth but these functions can be used by any middleware to add a custom logout implementation.

I'm also thinking of your proposal, as a more generic view, e.g. to have a Context.User() which will return a User interface (e.g. (User {Username(), ...} ) which can be customized by middleware(s), e.g. sessions, basicauth, casbin and e.t.c.

Sounds good?

[tuhao1020]

@kataras Sounds fantastic! 👍

[kataras]

Hello @tuhao1020, so far the implementation of that User feature is simple, and the basic auth middleware supports it:

// SetUser sets a User for this request.
// It's used by auth middlewares as a common
// method to provide user information to the
// next handlers in the chain.
Context.SetUser(u User)

// User returns the registered User of this request.
// See `SetUser` too.
Context.User() User

The User interface looks like this:

package context

import (
	"errors"
	"time"
)

// ErrNotSupported is fired when a specific method is not implemented
// or not supported entirely.
// Can be used by User implementations when
// an authentication system does not implement a specific, but required,
// method of the User interface.
var ErrNotSupported = errors.New("not supported")

// User is a generic view of an authorized client.
// See `Context.User` and `SetUser` methods for more.
//
// The informational methods starts with a "Get" prefix
// in order to allow the implementation to contain exported
// fields such as `Username` so they can be JSON encoded when necessary.
//
// The caller is free to cast this with the implementation directly
// when special features are offered by the authorization system.
type User interface {
	// GetAuthorization should return the authorization method,
	// e.g. Basic Authentication.
	GetAuthorization() string
	// GetAuthorizedAt should return the exact time the
	// client has been authorized for the "first" time.
	GetAuthorizedAt() time.Time
	// GetUsername should return the name of the User.
	GetUsername() string
	// GetPassword should return the encoded or raw password
	// (depends on the implementation) of the User.
	GetPassword() string
	// GetEmail should return the e-mail of the User.
	GetEmail() string
}

// FeaturedUser optional interface that a User can implement.
type FeaturedUser interface {
	User
	// GetFeatures should optionally return a list of features
	// the User implementation offers.
	GetFeatures() []UserFeature
}

// UserFeature a type which represents a user's optional feature.
// See `HasUserFeature` function for more.
type UserFeature uint32

// The list of standard UserFeatures.
const (
	AuthorizedAtFeature UserFeature = iota
	UsernameFeature
	PasswordFeature
	EmailFeature
)

// HasUserFeature reports whether the "u" User
// implements a specific "feature" User Feature.
//
// It returns ErrNotSupported if a user does not implement
// the FeaturedUser interface.
func HasUserFeature(user User, feature UserFeature) (bool, error) {
	if u, ok := user.(FeaturedUser); ok {
		for _, f := range u.GetFeatures() {
			if f == feature {
				return true, nil
			}
		}

		return false, nil
	}

	return false, ErrNotSupported
}

// SimpleUser is a simple implementation of the User interface.
type SimpleUser struct {
	Authorization string        `json:"authorization"`
	AuthorizedAt  time.Time     `json:"authorized_at"`
	Username      string        `json:"username"`
	Password      string        `json:"-"`
	Email         string        `json:"email,omitempty"`
	Features      []UserFeature `json:"-"`
}

var _ User = (*SimpleUser)(nil)

// GetAuthorization returns the authorization method,
// e.g. Basic Authentication.
func (u *SimpleUser) GetAuthorization() string {
	return u.Authorization
}

// GetAuthorizedAt returns the exact time the
// client has been authorized for the "first" time.
func (u *SimpleUser) GetAuthorizedAt() time.Time {
	return u.AuthorizedAt
}

// GetUsername returns the name of the User.
func (u *SimpleUser) GetUsername() string {
	return u.Username
}

// GetPassword returns the raw password of the User.
func (u *SimpleUser) GetPassword() string {
	return u.Password
}

// GetEmail returns the e-mail of the User.
func (u *SimpleUser) GetEmail() string {
	return u.Email
}

// GetFeatures returns a list of features
// this User implementation offers.
func (u *SimpleUser) GetFeatures() []UserFeature {
	if u.Features != nil {
		return u.Features
	}

	var features []UserFeature

	if !u.AuthorizedAt.IsZero() {
		features = append(features, AuthorizedAtFeature)
	}

	if u.Username != "" {
		features = append(features, UsernameFeature)
	}

	if u.Password != "" {
		features = append(features, PasswordFeature)
	}

	if u.Email != "" {
		features = append(features, EmailFeature)
	}

	return features
}

[AlbinoGeek]

You are well on your way to competing with more robust frameworks by implementing this, very interesting indeed!