svn commit: r788971 - in /couchdb/trunk: etc/couchdb/default.ini.tpl.in share/www/script/test/security_validation.js src/couchdb/couch_httpd_misc_handlers.erl

[jc...@apache.org]

Author: jchris
Date: Sat Jun 27 13:36:29 2009
New Revision: 788971

URL: http://svn.apache.org/viewvc?rev=788971&view=rev
Log:
A /_whoami handler to provide client apps with access to the active userCtx for their session.
Thanks to the CouchDB University students and janl for helping to implement this.

Modified:
    couchdb/trunk/etc/couchdb/default.ini.tpl.in
    couchdb/trunk/share/www/script/test/security_validation.js
    couchdb/trunk/src/couchdb/couch_httpd_misc_handlers.erl

Modified: couchdb/trunk/etc/couchdb/default.ini.tpl.in
URL: http://svn.apache.org/viewvc/couchdb/trunk/etc/couchdb/default.ini.tpl.in?rev=788971&r1=788970&r2=788971&view=diff
==============================================================================
--- couchdb/trunk/etc/couchdb/default.ini.tpl.in (original)
+++ couchdb/trunk/etc/couchdb/default.ini.tpl.in Sat Jun 27 13:36:29 2009
@@ -62,6 +62,7 @@
 _stats = {couch_httpd_stats_handlers, handle_stats_req}
 _log = {couch_httpd_misc_handlers, handle_log_req}
 _sleep = {couch_httpd_misc_handlers, handle_sleep_req}
+_whoami = {couch_httpd_misc_handlers, handle_whoami_req}
 
 [httpd_db_handlers]
 _compact = {couch_httpd_db, handle_compact_req}

Modified: couchdb/trunk/share/www/script/test/security_validation.js
URL: http://svn.apache.org/viewvc/couchdb/trunk/share/www/script/test/security_validation.js?rev=788971&r1=788970&r2=788971&view=diff
==============================================================================
--- couchdb/trunk/share/www/script/test/security_validation.js (original)
+++ couchdb/trunk/share/www/script/test/security_validation.js Sat Jun 27 13:36:29 2009
@@ -60,6 +60,11 @@
         T(wrongPasswordDb.last_req.status == 401);
       }
 
+      // test force_login=true. 
+      var resp = wrongPasswordDb.request("GET", "/_whoami?force_login=true");    
+      var err = JSON.parse(resp.responseText);
+      T(err.error == "unauthorized");
+      T(resp.status == 401);
 
       // Create the design doc that will run custom validation code
       var designDoc = {
@@ -99,6 +104,14 @@
 
       T(userDb.save(designDoc).ok);
 
+      // test the _whoami endpoint
+      var resp = userDb.request("GET", "/_whoami");
+      var user = JSON.parse(resp.responseText)
+      T(user.name == "Damien Katz");
+      // test that the roles are listed properly
+      TEquals(user.roles, []);
+      
+
       // update the document
       var doc = userDb.open("testdoc");
       doc.foo=2;

Modified: couchdb/trunk/src/couchdb/couch_httpd_misc_handlers.erl
URL: http://svn.apache.org/viewvc/couchdb/trunk/src/couchdb/couch_httpd_misc_handlers.erl?rev=788971&r1=788970&r2=788971&view=diff
==============================================================================
--- couchdb/trunk/src/couchdb/couch_httpd_misc_handlers.erl (original)
+++ couchdb/trunk/src/couchdb/couch_httpd_misc_handlers.erl Sat Jun 27 13:36:29 2009
@@ -15,7 +15,7 @@
 -export([handle_welcome_req/2,handle_favicon_req/2,handle_utils_dir_req/2,
     handle_all_dbs_req/1,handle_replicate_req/1,handle_restart_req/1,
     handle_uuids_req/1,handle_config_req/1,handle_log_req/1,
-    handle_task_status_req/1,handle_sleep_req/1]).
+    handle_task_status_req/1,handle_sleep_req/1,handle_whoami_req/1]).
     
 -export([increment_update_seq_req/2]).
 
@@ -216,3 +216,22 @@
     send_chunk(Resp, "");
 handle_log_req(Req) ->
     send_method_not_allowed(Req, "GET").
+
+
+% whoami handler
+handle_whoami_req(#httpd{method='GET', user_ctx=UserCtx}=Req) ->
+    Name = UserCtx#user_ctx.name,
+    Roles = UserCtx#user_ctx.roles,
+    ForceLogin = couch_httpd:qs_value(Req, "force_login", "false"),
+    case {Name, ForceLogin} of
+        {null, "true"} ->
+            throw({unauthorized, <<"Please login.">>});
+        _False -> ok
+    end,
+    send_json(Req, {[
+        {ok, true},
+        {name, Name},
+        {roles, Roles}
+    ]});
+handle_whoami_req(Req) ->
+    send_method_not_allowed(Req, "GET").