File Coverage

blib/lib/Mojolicious/Plugin/BasicAuthPlus.pm

Criterion	Covered	Total	%
statement	52	58	89.6
branch	24	38	63.1
condition	14	19	73.6
subroutine	12	13	92.3
pod	1	1	100.0
total	103	129	79.8

package Mojolicious::Plugin::BasicAuthPlus;

use Mojo::Base 'Mojolicious::Plugin';
use Mojo::ByteStream;
use Authen::Simple::Password;
use Authen::Simple::Passwd;
use Authen::Simple::LDAP;

our $VERSION = '0.08';

sub register {
    my ( $plugin, $app ) = @_;

    $app->renderer->add_helper(
        basic_auth => sub {
            my $self = shift;

            # Sent credentials
            my $auth = $self->req->url->to_abs->userinfo || '';

            # Required credentials
            my ( $realm, $password, $username ) = $plugin->_expected_auth(@_);
            my $callback = $password if ref $password eq 'CODE';
            my $params   = $password if ref $password eq 'HASH';

            # No credentials entered
            return $plugin->_password_prompt( $self, $realm )
                if !$auth
                    and !$callback
                    and !$params;

            # Hash to hold return data
            my %data;
            $data{username} = $username;

            # Verification within callback
            return (\%data, 1)
                if $callback and $callback->( split /:/, $auth, 2 );

            # Verified with realm => username => password syntax
            return (\%data, 1)
                if $auth eq ( $username || '' ) . ":$password";

            # Verified via simple, passwd file, LDAP, or Active Directory.
            if ($auth) {
                if ( $params->{'username'} and $params->{'password'} ) {
                    return (\%data, 1)
                        if $plugin->_check_simple( $self, $auth, $params );
                }
                elsif ( $params->{'path'} ) {
                    return (\%data, 1)
                        if $plugin->_check_passwd( $self, $auth, $params );
                }
                elsif ( $params->{'host'} ) {
                    return (\%data, 1)
                        if $plugin->_check_ldap( $self, $auth, $params );
                }
            }

            # Not verified
            return $plugin->_password_prompt( $self, $realm );
        }
    );
}

sub _expected_auth {
    my $self  = shift;
    my $realm = shift;

    return @$realm{qw/ realm password username /} if ref $realm eq "HASH";

    # realm, pass, user || realm, pass, undef || realm, callback
    return $realm, reverse @_;
}

sub _password_prompt {
    my ( $self, $c, $realm ) = @_;

    $c->res->headers->www_authenticate("Basic realm=\"$realm\"");
    $c->res->code(401);
    $c->rendered;

    return;
}

sub _split_auth {
    my ( $username, $password ) = split ':', $_[0];

    $username = '' unless defined $username;
    $password = '' unless defined $password;

    return ( $username, $password );
}

sub _check_simple {
    my ( $self, $c, $auth, $params ) = @_;
    my ( $username, $password ) = _split_auth($auth);

    return 1
        if $username eq $params->{'username'}
            and Authen::Simple::Password->check( $password,
                $params->{'password'} );
}

sub _check_ldap {
    my ( $self, $c, $auth, $params ) = @_;
    my ( $username, $password ) = _split_auth($auth);

    return 0 unless defined $password;
    my $ldap = Authen::Simple::LDAP->new(%$params);

    return 1 if $ldap->authenticate( $username, $password );
}

sub _check_passwd {
    my ( $self, $c, $auth, $params ) = @_;
    my ( $username, $password ) = _split_auth($auth);

    my $passwd = Authen::Simple::Passwd->new(%$params);

    return 1 if $passwd->authenticate( $username, $password );
}

1;

__END__