File Coverage

blib/lib/Mojolicious/Plugin/Authentication.pm

Criterion	Covered	Total	%
statement	131	146	89.7
branch	35	44	79.5
condition	18	27	66.6
subroutine	25	29	86.2
pod	1	7	14.2
total	210	253	83.0

use warnings;
use strict;

package Mojolicious::Plugin::Authentication;

our $VERSION = '1.39';

use Mojo::Base 'Mojolicious::Plugin';
use Mojo::Promise;

sub register {
    my ($self, $app, $args) = @_;

    $args = { %{ $args || {} } }; # copy as mutating

    for my $cb_name (qw(load_user validate_user)) {
        my $p_name = $cb_name."_p";
        die __PACKAGE__, ": missing '$cb_name' subroutine ref in parameters\n"
            unless grep ref eq 'CODE', @$args{$cb_name, $p_name};
        $args->{$p_name} = sub {
            my @r = eval { $args->{$cb_name}->(@_) };
            $@ ? Mojo::Promise->reject($@) : Mojo::Promise->resolve(@r);
        } if !$args->{$p_name};
    }

    if (defined $args->{lazy}) {
        warn __PACKAGE__,
            ": the 'lazy' option is deprecated, ",
            "use 'autoload_user' instead\n";

        $args->{autoload_user} = delete $args->{lazy};
    }

    my $autoload_user     = $args->{autoload_user}   // 0;
    my $session_key       = $args->{session_key}     || 'auth_data';
    my $our_stash_key     = $args->{stash_key}       || '__authentication__';
    my $current_user_fn   = $args->{current_user_fn} || 'current_user';
    my $load_user_cb      = $args->{load_user};
    my $validate_user_cb  = $args->{validate_user};
    my $load_user_cb_p    = $args->{load_user_p};
    my $validate_user_cb_p= $args->{validate_user_p};

    my $fail_render = ref $args->{fail_render} eq 'CODE'
       ? $args->{fail_render} : sub { $args->{fail_render} };

    my $user_loader_sub = user_loader_closure(
        $our_stash_key, $session_key, $load_user_cb,
    );
    my $user_loader_sub_p = user_loader_closure_p(
        $our_stash_key, $session_key, $load_user_cb_p,
    );

    my $current_user = user_stash_extractor_closure(
        $our_stash_key, $user_loader_sub,
    );
    my $current_user_p = user_stash_extractor_closure_p(
        $our_stash_key, $user_loader_sub_p,
    );

    $app->helper(authenticate => authenticate_closure(
        $our_stash_key, $session_key, $validate_user_cb, $current_user,
    ));
    $app->helper(authenticate_p => authenticate_closure_p(
        $our_stash_key, $session_key, $validate_user_cb_p, $current_user_p,
    ));

    $app->hook(before_dispatch => $user_loader_sub_p) if $autoload_user;

    $app->routes->add_condition(authenticated => sub {
        my ($r, $c, $captures, $required) = @_;
        my $res = (!$required or $c->is_user_authenticated);

        unless ($res) {
          my $fail = $fail_render->(@_);
          $c->render(%{$fail}) if $fail;
        }
        return $res;
    });

    $app->routes->add_condition(signed => sub {
        my ($r, $c, $captures, $required) = @_;
        return (!$required or $c->signature_exists);
    });

    # deprecation handling
    $app->helper(user_exists => sub {
        warn __PACKAGE__,
            ": the 'user_exists' helper is deprecated, ",
            "use 'is_user_authenticated' instead\n";
        return shift->is_user_authenticated(@_);
    });

    $app->helper(user => sub {
        warn __PACKAGE__,
            ": the 'user' helper is deprecated, ",
            "use '$current_user_fn' instead\n";
        return shift->$current_user_fn(@_);
    });

    $app->helper(reload_user => sub {
        my $c = shift;
        # Clear stash to force a reload of the user object
        delete $c->stash->{$our_stash_key};
        return $current_user->($c);
    });
    $app->helper(reload_user_p => sub {
        my $c = shift;
        # Clear stash to force a reload of the user object
        delete $c->stash->{$our_stash_key};
        return $current_user_p->($c);
    });

    $app->helper(signature_exists => sub {
        my $c = shift;
        return !!$c->session($session_key);
    });

    $app->helper(is_user_authenticated => sub {
        my $c = shift;
        return defined $current_user->($c);
    });
    $app->helper(is_user_authenticated_p => sub {
        my $c = shift;
        $current_user_p->($c)->then(sub {
            return defined $_[0];
        });
    });

    $app->helper($current_user_fn => $current_user);
    $app->helper($current_user_fn."_p" => $current_user_p);

    $app->helper(logout => sub {
        my $c = shift;
        delete $c->stash->{$our_stash_key};
        delete $c->session->{$session_key};
        return 1;
    });
}

# Unconditionally load the user based on uid in session
sub user_loader_closure {
    my ($our_stash_key, $session_key, $load_user_cb) = @_;
    sub {
        my $c = shift;
        my $uid = $c->session($session_key);
        return if !defined $uid;
        my $user = $load_user_cb->($c, $uid);
        if ($user) {
            $c->stash($our_stash_key => { user => $user });
        }
        else {
            # cache result that user does not exist
            $c->stash($our_stash_key => { no_user => 1 });
        }
    };
}
sub user_loader_closure_p {
    my ($our_stash_key, $session_key, $load_user_cb_p) = @_;
    sub {
        my $c = shift;
        my $uid = $c->session($session_key);
        return Mojo::Promise->resolve if !defined $uid;
        $load_user_cb_p->($c, $uid)->then(sub {
            my $user = $_[0];
            if ($user) {
                $c->stash($our_stash_key => { user => $user });
            }
            else {
                # cache result that user does not exist
                $c->stash($our_stash_key => { no_user => 1 });
            }
        });
    };
}

# Fetch the current user object from the stash - loading it if
# not already loaded
sub user_stash_extractor_closure {
    my ($our_stash_key, $user_loader_sub) = @_;
    sub {
        my ($c, $user) = @_;
        # Allow setting the current_user
        if ( defined $user ) {
            $c->stash($our_stash_key => { user => $user });
            return;
        }
        my $stash = $c->stash($our_stash_key);
        $user_loader_sub->($c)
            unless $stash->{no_user} or defined $stash->{user};
        $stash = $c->stash($our_stash_key);
        return $stash->{user};
    };
}
sub user_stash_extractor_closure_p {
    my ($our_stash_key, $user_loader_sub_p) = @_;
    sub {
        my ($c, $user) = @_;
        # Allow setting the current_user
        if ( defined $user ) {
            return Mojo::Promise->resolve->then(sub {
                $c->stash($our_stash_key => { user => $user });
            });
        }
        my $stash = $c->stash($our_stash_key);
        my $promise = ($stash->{no_user} or defined $stash->{user})
            ? Mojo::Promise->resolve
            : $user_loader_sub_p->($c);
        $promise->then(sub {
            $stash = $c->stash($our_stash_key);
            return $stash->{user};
        });
    };
}

sub authenticate_closure {
    my ($our_stash_key, $session_key, $validate_user_cb, $current_user) = @_;
    sub {
        my ($c, $user, $pass, $extradata) = @_;
        # if extradata contains "auto_validate", assume the passed username
        # is in fact valid, and auto_validate contains the uid; used for
        # OAuth and other stuff that does not work with usernames and
        # passwords; use this with extreme care if you must
        $extradata ||= {};
        my $uid = $extradata->{auto_validate} //
            $validate_user_cb->($c, $user, $pass, $extradata);
        return undef if !defined $uid;
        $c->session($session_key => $uid);
        # Clear stash to force reload of any already loaded user object
        delete $c->stash->{$our_stash_key};
        return 1 if defined $current_user->($c);
        return undef;
    };
}
sub authenticate_closure_p {
    my ($our_stash_key, $session_key, $validate_user_cb_p, $current_user_p) = @_;
    sub {
        my ($c, $user, $pass, $extradata) = @_;
        $extradata ||= {};
        my $promise = defined($extradata->{auto_validate})
            ? Mojo::Promise->resolve($extradata->{auto_validate})
            : $validate_user_cb_p->($c, $user, $pass, $extradata);
        $promise->then(sub {
            my ($uid) = @_;
            return undef if !defined $uid;
            $c->session($session_key => $uid);
            # Clear stash to force reload of any already loaded user object
            delete $c->stash->{$our_stash_key};
            $current_user_p->($c);
        })->then(sub {
            defined $_[0] ? 1 : undef;
        });
    };
}

1;

__END__