Auth, Sessions and Middleware

[bshepherdson]

Context

I'm porting an early stage Datastar app from Templ and vanilla net/http to Via - it's magical! Tons of fiddly wrangling of signals between JSON and Go structs has melted away, and my struggles to create reusable components that could support multiple instances on screen at once have been solved neatly!

However, one thing I am struggling with is the lack of pluggable behaviour around the HTTP requests/responses. My original app uses Gorilla sessions to store a blob in a cookie, and use that to persist a bit of per-user state. (Long term, it would probably be storing a session ID and looking up the session in a database, but for now it's a protobuf in a cookie.)

Question

How would you implement authentication, authorization and sessions on top of Via?

My Thoughts

I've got two ideas, and I'm messing around with them locally. I just wanted to make sure I hadn't missed a best practice or example.

Idea 1: c.Middleware hook

I'm currently playing around with func (c *Context) Middleware(mw func(w http.ResponseWriter, r *http.Request) error) { ... } but that feels clumsy. Like you get access to the http.Handler bits but you have to be gentle with w to avoid breaking the rest of the Page.

Idea 2: Inverting Page

I also wonder about inverting the way V.Page works, where the user writes the http.Handler more directly, allowing them to do HTTP-level stuff like redirects, 403s, cookies, custom headers, etc. and then calling into Via for the heart of rendering the response.

Perhaps v.Route("/some/path", func(w http.ResponseWriter, r *http.Request) { ... })) does any session-y things with the request, path or query parameters, etc. and then calls the core of what is Page() today as the final(?) step, probably like v.Page(w, func(c *via.Context) { ... }).

This has the advantage of moving ad-hoc things like the GetPathParam() handling out of Via and into user land. It has the serious disadvantage of being a top-level API change, of course.

[joaomdsg]

Hi Braden!

Im terribly sorry to have missed your post until now.

Your ideas are very appreciated. Thanks!

I have been struggling to design a complete user auth lifecycle and user scoped state that is available in view and actions, But with the latest release of via (large api and untime update) im getting closer and closer of solving this.

Planning to have for next release: v.Group(g *via.Group), v.Middleware(ctx *via.Ctx), and a fully working example with user auth bound to a cookie and user scoped state.

Cheers!