Note that there are some explanatory texts on larger screens.

plurals
  1. POHow to add a filter in in the "middle of the URL" using Restlet?
    primarykey
    data
    text
    <p>I have the following routes:</p> <p><code>/projects/{projectName}</code></p> <p>and </p> <p><code>/projects/{projectName}/Wall/{wallName}</code></p> <p>Now I'd like to have that all GETs be allowed but PUT, POST, DELETE should only be allowed by project members i.e. users members of that project. I have a special class that given a user id and project name I can get the status of the user's membership - something like <code>MyEnroler.getRole(userId, projectName)</code> - where the userId is part of the request header and the <code>projectName</code> is taken from the URI. </p> <p>I've tried a number of things but doesn't work. Here's the idea:</p> <pre><code>public class RoleMethodAuthorizer extends Authorizer { @Override protected boolean authorize(Request req, Response resp) { //If it's a get request then no need for further authorization. if(req.getMethod().equals(Method.GET)) return true; else { String authorEmail = req.getClientInfo().getUser().getIdentifier(); String projectName = req.getAttributes().get("project").toString(); Role userRole = MyEnroler.getRole(authorEmail, projectName); //forbid updates to resources if done by non-members of project if(userRole.equals(MyEnroler.NON_MEMBER)) return false; //for everybody else, return true return true; } } } </code></pre> <p>Now simply doing the following completely fails when creating inbound root in the Application:</p> <pre><code>Router projectRouter = new Router(getContext()); RoleMethodAuthorizer rma = new RoleMethodAuthorizer(); //Guard declaration here. Then setNext Restlet guard.setNext(projectRouter); projectRouter.attach("/projects/{project}",rma); Router wallRouter = new Router(getContext()); wallRouter.attach("/Wall/{wallName}", WallResource.class); rma.setNext(wallRouter); //return guard; </code></pre> <p>So a request to <code>/projects/stackoverflow/Wall/restlet</code> fails. The URL is never found. I'm guessing since it's trying to match it with the <code>projectRouter</code>. Well I tried the various modes (<code>MODE_BEST_MATCH or MODE_FIRST/NEXT_MATCH</code>) to no avail.</p> <p>Nothing seems to work. Conceptually this should work. I'm only intercepting a call and just being transparent to the request, but don't know how things are working on the inside.</p> <p>I could move the authorizer just after the guard, but I'd lose access to the <code>request attribute</code> of <code>projectName</code> - I don't wish to parse the URL myself to search for the projectName since the URL pattern could change and would break the functionality - i.e. require 2 changes instead of one.</p> <p>Any ideas how to achieve this?</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload