-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Create abstraction for login related operations in authentication module #2491
Comments
Similarly to what I wrote in #2435 (comment), I see two distinctive services here:
While it makes sense to me to have an interface describing a service that can convert credentials into a user profile (perform the login), I find it problematic to implement transport specific behavior in a service. How do we envision that such service would be used from a controller? It's important to describe the IMO, extract & invalidate credentials should not be provided by any service, but should be implemented as controller actions leveraging the services described in #2435 under the hood. class UserController {
constructor (
// inject response, AccessTokenService, TokenTransportStrategy and LoginService
) {}
@post('/login')
async login(
@param() email: string,
@param() password: string,
) {
const user = await this.loginService.verifyCredentials({email, password});
const token = await this.tokenService.generateAccessToken(user);
await this.transportStrategy.serializeAccessToken(this.response);
// uh oh, what is the return value of this method?
// if the token is returned in response body, how are we going to describe response schema?
}
@post('/logout')
async logout(
@inject('current access token') token: string
) {
await this.tokenService.invalidateAccessToken(token);
}
} Also the entire idea of I am not sure how much value that leaves for the |
This is true...I haven't figured out a good solution for providing the spec. In PR #2576 we moved the login logic from controller function to the auth action, which also may also affect the API definition. May need more time to come up with a better plan. |
Implemented as a |
Description / Steps to reproduce / Feature proposal
Description
Create abstraction for login service.
login(request: Request): Promise<U>
extractCredentials(request: Request): Promise<C>
verifyCredentials(credentials: C): Promise<U>
invalidateCredentials?(request: Request): Promise<boolean>
The text was updated successfully, but these errors were encountered: