servant-auth-token 0.4.3.0 → 0.4.4.0

raw patch · 4 files changed

+32/−2 lines, 4 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• CHANGELOG.md +5/−0
• servant-auth-token.cabal +1/−1
• src/Servant/Server/Auth/Token.hs +25/−0
• stack.yaml +1/−1

@@ -1,3 +1,8 @@+0.4.4.0+=======++* Add `signinByHashUnsafe` for internal usage. + 0.4.3.0 ======= 

@@ -1,5 +1,5 @@ name:                servant-auth-token-version:             0.4.3.0+version:             0.4.4.0 synopsis:            Servant based API and server for token based authorisation description:         Please see README.md homepage:            https://github.com/ncrashed/servant-auth-token#readme

@@ -65,6 +65,7 @@   , hashPassword   , setUserPasswordHash   , ensureAdminHash+  , signinByHashUnsafe   ) where  import Control.Monad@@ -606,3 +607,27 @@   whenNothing madmin $ do     i <- createAdmin strength login "" email     setUserPasswordHash passHash $ fromKey i++-- | If you use password hash in configs, you cannot use them in signin+-- method. This helper allows to get token by password hash and the function+-- is not available for remote call (no endpoint).+--+-- Throws 401 if cannot find user or authorisation is failed.+--+-- WARNING: Do not expose the function to end user, never!+signinByHashUnsafe :: AuthHandler m => Login -- ^ User login+  -> Text -- ^ Hash of admin password+  -> Maybe Seconds -- ^ Expire+  -> m SimpleToken+signinByHashUnsafe login pass mexpire = do+  WithField uid UserImpl{..} <- guardLogin login pass+  getAuthToken uid mexpire+  where+  guardLogin login pass = do -- check login and password, return passed user+    muser <- getUserImplByLogin login+    let err = throw401 "Cannot find user with given combination of login and pass"+    case muser of+      Nothing -> err+      Just user@(WithField _ UserImpl{..}) -> if pass == userImplPassword+        then return user+        else err

@@ -47,7 +47,7 @@ #     git: https://github.com/NCrashed/servant-auth-token-api.git #     commit: d011f7bfecd18d07ff67ce9f67f8741e110a2719 #   extra-dep: true-- '../servant-auth-token-api'+# - '../servant-auth-token-api'  # Dependency packages to be pulled from upstream that are not in the resolver # (e.g., acme-missiles-0.3)