Implement a standard access control system which guards access based on: User, Resource, Action. Find a library that already provides this functionality and integrate it with server.

Implement a middleware handler which checks an access request and store the result in metadata.

https://github.com/hlandau/passlib

Picasso

A key idea in the handler system in the idea of API resources which actions can be performed on. This can be achieved by registering handlers with different actions under the same path.

A controller makes this process easier. A controller has:

• Data
  • A path array (Similar to a handler)
  • A handler array
  • A middleware handler array
  • A middleware exclusion array
  • Specifies which handlers the middleware does not apply to via action type
  • If empty no handlers are excluded
• Methods
  • Getters for all data
    • For the handlers provide a RawHandlers getter and a HandlersWithMiddleware getter (pseudonames, find better ones)
  • Add handler method
  • Add middleware method
  • Exclude action from middleware method
  • Test if action excluded method

All handlers in the handler array will be registered under the controllers path + their path. Additionally all handlers defined in the controller will have the same middleware applied to them.

Add authentication to the server via JWTs.

• Token struct
  • func parse(rawAuthToken string) (error, Token) to convert JWT text into a struct
  • Token struct to hold information
  • func (t Token) ToJWTString() string to convert a Token to a JWT in string form
• Handlers
  • A handler which parses a JWT from the request if it exists and adds it to the metadata
  • A handler which will only succeed if authenticated

Determine the best setup for unmarshalling data for handlers.

• Exact matching struct for request data
• Unmarshall into a map[string]interface{}
  • Should these be verified versus a schema

Middleware can run before a primary handler. This is done via:

• MiddlewareHandler struct
  • Implements the Handler interface
    • Calls each of the middleware functions
    • If any middleware returns an error it is returned to the user
    • If middleware executes successfully primary handler is called
  • Contains primary handler field
  • Contains list of middleware handlers
  • Getters for all fields
  • Add method for middleware
• Middleware handler interface
  • Defines what actions should take place when a certain piece of middleware runs
  • Similar to a regular handler: Handle(data HandlerData, metadata *Metadata) error except it can't return data
  • Instead middleware stores data via the metadata struct.

Consider how analytics will be recorded. Current ideas:

• Record to Prometheus
• Middleware which at the very least records access analytics
• Run all user ids through a 1 way hasher for anonymity
• Response time
  • Save start time in Metadata
  • Modify endpoint handler so it has pre and post endpoints (probably a good idea anyway)

Implement the metadata struct. The purpose is to hold information about the request created by the application itself. It should provide explicit get and set methods for the following:

• Auth data
• Auth status
• Verified schema's
• Authorized event targets

Auth vs Authorized: Auth refers to authentication information, Authorized refers to permission to carry out an action at a path

Retrofit

A struct needs to be created that ties the whole handler system together. It should complete the following tasks:

• Bulk register handlers for a provided controller
• Implement the Multi Transport idea described below

Multi Transport

The Multi Transport should keep track of all other valid transports via a map[TransportType]*Transport. When it receives a request to register a handler it should proxy that request to the correct Transport in the map.

Save the complete checksum of resources. Make certain actions check the ETag first to see if client has latest version of resource.

Maybe cache these ETags in something like Redis as well to reduce needless DB load.

Backblaze B2
Blazer golang lib