servant-auth-token-api 0.4.2.2 → 0.5.1.0
raw patch · 3 files changed
+71/−3 lines, 3 filesdep ~aeson-injectordep ~swagger2PVP ok
version bump matches the API change (PVP)
Dependency ranges changed: aeson-injector, swagger2
API changes (from Hackage documentation)
- Servant.API.Auth.Token.Pagination: instance (Data.Aeson.Types.FromJSON.FromJSON i0, Data.Aeson.Types.FromJSON.FromJSON a0) => Data.Aeson.Types.FromJSON.FromJSON (Servant.API.Auth.Token.Pagination.PagedList i0 a0)
- Servant.API.Auth.Token.Pagination: instance (Data.Aeson.Types.ToJSON.ToJSON i0, Data.Aeson.Types.ToJSON.ToJSON a0) => Data.Aeson.Types.ToJSON.ToJSON (Servant.API.Auth.Token.Pagination.PagedList i0 a0)
+ Servant.API.Auth.Token: AuthSigninPostBody :: !Login -> !Password -> !(Maybe Seconds) -> AuthSigninPostBody
+ Servant.API.Auth.Token: [authSigninBodyLogin] :: AuthSigninPostBody -> !Login
+ Servant.API.Auth.Token: [authSigninBodyPassword] :: AuthSigninPostBody -> !Password
+ Servant.API.Auth.Token: [authSigninBodySeconds] :: AuthSigninPostBody -> !(Maybe Seconds)
+ Servant.API.Auth.Token: data AuthSigninPostBody
+ Servant.API.Auth.Token: instance Data.Aeson.Types.FromJSON.FromJSON Servant.API.Auth.Token.AuthSigninPostBody
+ Servant.API.Auth.Token: instance Data.Aeson.Types.ToJSON.ToJSON Servant.API.Auth.Token.AuthSigninPostBody
+ Servant.API.Auth.Token: instance Data.Swagger.Internal.Schema.ToSchema Servant.API.Auth.Token.AuthSigninPostBody
+ Servant.API.Auth.Token: instance GHC.Generics.Generic Servant.API.Auth.Token.AuthSigninPostBody
+ Servant.API.Auth.Token: instance GHC.Show.Show Servant.API.Auth.Token.AuthSigninPostBody
+ Servant.API.Auth.Token: instance Servant.Docs.Internal.ToSample Servant.API.Auth.Token.AuthSigninPostBody
+ Servant.API.Auth.Token: type AuthSigninPostMethod = "auth" :> ("signin" :> (ReqBody '[JSON] AuthSigninPostBody :> Post '[JSON] (OnlyField "token" SimpleToken)))
+ Servant.API.Auth.Token.Pagination: instance (Data.Aeson.Types.FromJSON.FromJSON i, Data.Aeson.Types.FromJSON.FromJSON a) => Data.Aeson.Types.FromJSON.FromJSON (Servant.API.Auth.Token.Pagination.PagedList i a)
+ Servant.API.Auth.Token.Pagination: instance (Data.Aeson.Types.ToJSON.ToJSON i, Data.Aeson.Types.ToJSON.ToJSON a) => Data.Aeson.Types.ToJSON.ToJSON (Servant.API.Auth.Token.Pagination.PagedList i a)
- Servant.API.Auth.Token: downgradeToken :: True ~ PermsSubset ts' ts => MToken ts -> MToken ts'
+ Servant.API.Auth.Token: downgradeToken :: 'True ~ PermsSubset ts' ts => MToken ts -> MToken ts'
- Servant.API.Auth.Token: downgradeToken' :: True ~ PermsSubset ts' ts => Token ts -> Token ts'
+ Servant.API.Auth.Token: downgradeToken' :: 'True ~ PermsSubset ts' ts => Token ts -> Token ts'
- Servant.API.Auth.Token: type AuthAPI = AuthSigninMethod :<|> (AuthSigninGetCodeMethod :<|> (AuthSigninPostCodeMethod :<|> (AuthTouchMethod :<|> (AuthTokenInfoMethod :<|> (AuthSignoutMethod :<|> (AuthSignupMethod :<|> (AuthUsersMethod :<|> (AuthGetUserMethod :<|> (AuthPatchUserMethod :<|> (AuthPutUserMethod :<|> (AuthDeleteUserMethod :<|> (AuthRestoreMethod :<|> (AuthGetSingleUseCodes :<|> (AuthGetGroupMethod :<|> (AuthPostGroupMethod :<|> (AuthPutGroupMethod :<|> (AuthPatchGroupMethod :<|> (AuthDeleteGroupMethod :<|> (AuthGroupsMethod :<|> (AuthCheckPermissionsMethod :<|> (AuthGetUserIdMethod :<|> AuthFindUserByLogin)))))))))))))))))))))
+ Servant.API.Auth.Token: type AuthAPI = AuthSigninMethod :<|> (AuthSigninPostMethod :<|> (AuthSigninGetCodeMethod :<|> (AuthSigninPostCodeMethod :<|> (AuthTouchMethod :<|> (AuthTokenInfoMethod :<|> (AuthSignoutMethod :<|> (AuthSignupMethod :<|> (AuthUsersMethod :<|> (AuthGetUserMethod :<|> (AuthPatchUserMethod :<|> (AuthPutUserMethod :<|> (AuthDeleteUserMethod :<|> (AuthRestoreMethod :<|> (AuthGetSingleUseCodes :<|> (AuthGetGroupMethod :<|> (AuthPostGroupMethod :<|> (AuthPutGroupMethod :<|> (AuthPatchGroupMethod :<|> (AuthDeleteGroupMethod :<|> (AuthGroupsMethod :<|> (AuthCheckPermissionsMethod :<|> (AuthGetUserIdMethod :<|> AuthFindUserByLogin))))))))))))))))))))))
Files
- CHANGELOG.md +10/−0
- servant-auth-token-api.cabal +3/−3
- src/Servant/API/Auth/Token.hs +58/−0
CHANGELOG.md view
@@ -1,3 +1,13 @@+0.5.1.0+=======++* Push version bounds.++0.5.0.0+=======++* Add `AuthSigninPostMethod` to substitute security weak `AuthSigninMethod`.+ 0.4.2.1 =======
servant-auth-token-api.cabal view
@@ -1,5 +1,5 @@ name: servant-auth-token-api-version: 0.4.2.2+version: 0.5.1.0 synopsis: Servant based API for token based authorisation description: Please see README.md homepage: https://github.com/ncrashed/servant-auth-token-api#readme@@ -29,13 +29,13 @@ build-depends: base >= 4.7 && < 5 , aeson >= 0.11 && < 1.3- , aeson-injector >= 1.0.4 && < 1.1+ , aeson-injector >= 1.0.4 && < 1.2 , lens >= 4.13 && < 5 , raw-strings-qq >= 1.1 && < 1.2 , servant >= 0.9 && < 0.13 , servant-docs >= 0.9 && < 0.13 , servant-swagger >= 1.1 && < 1.2- , swagger2 >= 2.1 && < 2.2+ , swagger2 >= 2.1 && < 2.3 , text >= 1.2 && < 2 default-language: Haskell2010
src/Servant/API/Auth/Token.hs view
@@ -22,6 +22,7 @@ -- * API specs AuthAPI , AuthSigninMethod+ , AuthSigninPostMethod , AuthSigninGetCodeMethod , AuthSigninPostCodeMethod , AuthTouchMethod@@ -77,6 +78,7 @@ , RespUserInfo(..) , PatchUser(..) , RespUsersInfo(..)+ , AuthSigninPostBody(..) -- ** User groups , UserGroupId , UserGroup(..)@@ -406,6 +408,37 @@ , patchUserGroupNoParent = Just True } +-- | Body for 'AuthSigninPostMethod'+data AuthSigninPostBody = AuthSigninPostBody {+ authSigninBodyLogin :: !Login+, authSigninBodyPassword :: !Password+, authSigninBodySeconds :: !(Maybe Seconds) -- ^ Nothing is default server value+} deriving (Generic, Show)+$(deriveJSON (derivePrefix "authSigninBody") ''AuthSigninPostBody)++instance ToSchema AuthSigninPostBody where+ declareNamedSchema = genericDeclareNamedSchema $+ schemaOptionsDropPrefix "authSigninBody"++instance ToSample AuthSigninPostBody where+ toSamples _ = samples [s1, s2, s3]+ where+ s1 = AuthSigninPostBody {+ authSigninBodyLogin = "admin"+ , authSigninBodyPassword = "123456"+ , authSigninBodySeconds = Nothing+ }+ s2 = AuthSigninPostBody {+ authSigninBodyLogin = "sviborg"+ , authSigninBodyPassword = "qwerty"+ , authSigninBodySeconds = Just 360+ }+ s3 = AuthSigninPostBody {+ authSigninBodyLogin = "schoolgirl"+ , authSigninBodyPassword = "ilovepony"+ , authSigninBodySeconds = Just 42+ }+ instance ToParam (QueryParam "login" Login) where toParam _ = DocQueryParam "login" ["ncrashed", "buddy"] "Any valid login for user" Normal instance ToParam (QueryParam "password" Password) where@@ -425,6 +458,7 @@ -- | Generic authorization API type AuthAPI = AuthSigninMethod+ :<|> AuthSigninPostMethod :<|> AuthSigninGetCodeMethod :<|> AuthSigninPostCodeMethod :<|> AuthTouchMethod@@ -472,6 +506,30 @@ :> QueryParam "password" Password :> QueryParam "expire" Seconds :> Get '[JSON] (OnlyField "token" SimpleToken)+{-# DEPRECATED AuthSigninMethod "AuthSigninPostMethod is more secure" #-}++-- | How to get a token, expire of 'Nothing' means+-- some default value (server config).+--+-- Logic of authorisation via this method is:+--+-- * Client sends POST request to the endpoint with+-- user specified login and password and optional expire+--+-- * Server responds with token or error+--+-- * Client uses the token with other requests as authorisation+-- header+--+-- * Client can extend lifetime of token by periodically pinging+-- of 'AuthTouchMethod' endpoint+--+-- * Client can invalidate token instantly by 'AuthSignoutMethod'+--+-- * Client can get info about user with 'AuthTokenInfoMethod' endpoint.+type AuthSigninPostMethod = "auth" :> "signin"+ :> ReqBody '[JSON] AuthSigninPostBody+ :> Post '[JSON] (OnlyField "token" SimpleToken) -- | Authorisation via code of single usage. --