More authorization scaffolding or access to request object?

[hugapi]

More authorization scaffolding or access to request object?

[timothycrosley]

Hi @ianthetechie,

I'm glad you've found hug useful thus far :)! I believe this should be possible currently: Falcon provides a context object on every request object that enables adding arbitrary additional information to a request, the hug authentication methods assign their result to the user key on this structure. I think all that would need to be put in place to make this entirely clean would be to add a user directive that would automatically pull this in, a local implementation would look like this:

import hug

authentication = hug.authentication.basic(hug.authentication.verify('User1', 'mypassword'))


@hug.directive()
def user(default=None, request=None, *args, **kwargs):
    '''Returns the current logged in user'''
    return request.context.get('user', None) if request else None


@hug.get(requires=authentication)
def home_page(hug_user):
    '''my home page'''
    if hug_user == x:
        # do_this
    else:
        # do_that

Let me know if this makes sense and if there are things beyond this that you think would make the Framework cleaner. I think at minimum adding the user directives to hugs built-in directives.py module would be helpful. If you want to take this task on or any other let me know, I would love to have you as a contributor :)

Thanks!

~Timothy

[ianthetechie]

Ahh! I was actually just looking at directive after the fact wondering if I could abuse them for such a purpose ;) I think that will do the trick. As you say though, it'd be nice to clean this up a little bit for such a common use case. I'll look into this more this afternoon (Eastern US Time) and if I come up with an acceptable solution, I'll happily submit a PR. If not, I'll continue discussion here.

Thanks for getting back so quickly!
Ian

[ianthetechie]

@timothycrosley this method does appear to work (though, at least in the current version of hug on pip, 1.9.9, I actually had to add a few extra arguments to the directive function). However, there are a few limitations I'm running into.

First, I have my API split across several files (one for each logical "section"), and if I declare my directive in my api root file, the other modules (added later via @hug.extend_api) don't see the directive. When I hit the endpoint, it informs me that I'm missing a parameter.

Second, I believe something along the chain is doing some interesting code introspection which can cause issues (in the version 1.9.9 code, this is on decorators.py, line 236). I admit this is probably not a use case that's easy to plan for, but I decorate my code heavily. This probably comes from doing too much Haskell and wishing that every language had the same ability to compose functions. The kinds of decorators I'm writing include per-function caching (memoization of functions against memcached) and injection of additional parameters for things like a class to access the database. The only way I can get the directives to work is to manually specify a parameters tuple.

Any thoughts on getting around these challenges? The version in pip appears to have some fairly major code differences from the github version, so I have a feeling some of this may have been addressed already.

Thanks again in advance!

[timothycrosley]

Hi @ianthetechie,

I'm glad to help in anyway I can! It's true that currently directives must be defined before the functions that use them, the easiest way to fix this would be to define your directive in a directives.py file and import it before you import the various sections of your app that use it.

Decorating your code heavily is fine and should be supported, however the decorator functions need to pass along a valid function signature and use functools.wraps at a minimum. Still, unfortunately there may be issues: http://blog.dscpl.com.au/2014/01/how-you-implemented-your-python.html, however there's an alternative way to specify directives available in 1.9.9 that can allow you to use them anyway:

import directives

def home_page(user: directives.user=None):
    '''my home page'''
    if user == x:
        # do_this
    else:
        # do_that

This should work as long as the decorators do the bare minimum of passing along the annotations from the function (which functools.wraps should do)

Hope this is helpful!

~Timothy

[ianthetechie]

Perfect; I'll give that alternative directives syntax a shot in a little bit here.

As for the decorators, I do indeed use functools.wraps on all of them (it will throw an epic exception if I don't). I'll post some code samples later to help with debugging if the new syntax doesn't help out.

Thanks again for the help, as always. It seems to me like you've actually got a lot more bases covered than are readily apparent. I'm beginning to think that I might be contributing more documentation than code ;)

[ianthetechie]

That worked out perfectly, and removed the need to manually declare the parameters tuple. I'll try to work up a PR with some convenience code and documentation for you in the next day or two. Is there any particular source of documentation besides the README, or should I just slip it in there?

[timothycrosley]

Sounds great!

The README.md file is the only source for now, and feel free to add anything you think would be helpful to it :). I've recently secured the hug.rest domain and am going to be working on setting up that as a source of more in-depth documentation for 2.0.0. As I get time to work on this It'll will be done here: https://github.com/timothycrosley/hug_website

Thanks!

~Timothy

[timothycrosley]

@ianthetechie,

As a small update to the decorator wrapping issue you ran into: I've added a hug.wraps decorator that acts as a drop in replacement for functools.wraps while preserving the original functions specification for use withing hug. This allows things like hug_x to work even if you wrap it several decorators deep.

Hope this is helpful!

Thanks,

~Timothy

[ianthetechie]

Very much helpful :) Thanks!