On 2013-04-17 20:32:50 UTC, John MacFarlane <
fiddlo...@gmail.com> wrote:
> Thomas,
>
> There's a TODO file in the repository, which lists features that
> gitit has that are still lacking in gitit2.
> Authentication/authorization is one of them.
>
> gitit1 supports several different authentication methods (see the
> README and the annotated config file), including one that involves
> storing hashed passwords and usernames in a file, complete with a
> password-reset email system etc. Some of this is ugly, and a case could
> be made for simplifying things in gitit2. In any case, starting with
> the Yesod authentication and authorization would make lots of sense.
> So, go ahead!
>
I wrote a yesod-auth based plugin to handle this kind of authentication recently. I haven't posted it on hackage yet since there were some improvements to yesod-auth I was waiting for, but plan on sticking the code on hackage. The (current) code is here
https://groups.google.com/forum/?fromgroups=#!topic/yesodweb/X8s7v7WEBEc
Looking at gitit2 and how it relates to authentication, here is one thought I had on how it could work with yesod-auth.
I would remove requireUser from the HasGitit class. Instead, I would make all authorization go through the isAuthorized (and authRoute and isWriteRequest) methods on the master site's Yesod instance, and all authentication go through yesod-auth. To facilite easy writing of isAuthorized, I would add a helper function like the following
data GititRouteType = ReadPage Page
| WritePage Page
| Other
-- Maybe more types here, not sure
gititRouteType :: Route Gitit -> GititRouteType
then one could write
instance Yesod MyApp where
....
isAuthorized (GititSubsite route) isWrite = do
muser <- maybeAuthId
case muser of
Nothing -> return AuthenticationRequired
Just user -> case gititRouteType route of
-- lookup if the user can access the page, or allow all, or whatever.
-------
This allows a lot of flexibility for people that embed the gitit subsite themselves. For people who just want to use a compiled version, gitit.hs could have several different possible isAuthorized functions, and then the provided master site could select between them based on a config setting.