haskell-servant / haskell-servant/servant
Route selection for endpoints protected by Cookie Auth
- Dominant language
- Haskell
- Stars
- 2k
- Forks
- 427
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 5
Description
Hello, I'm having an issue with the behavior of the router that I don't know how to resolve. I have the following Server definition:
```haskell
type HomeRoute = HXRequest :> Get '[HTML] (Partial Home)
type UnprotectedRoutes = HomeRoute
type ProtectedRoutes = HomeRoute
type Routes =
(Auth '[Cookie] Model.User :> ProtectedRoutes)
:<|> UnprotectedRoutes
```
As you can see, I have a `HomeRoute` under both `UnprotectedRoutes` and `ProtectedRoutes`. It returns a different home page depending on whether or not the user is logged in. The issue is that the routing mechanism doesn't seem to differentiate between
```haskell
Auth '[Cookie] Model.User :> HXRequest :> Get '[HTML] (Partial Home)
```
and
```haskell
HXRequest :> Get '[HTML] (Partial Home)
```
In my opinion, the way this should work is like this:
1. If the request from the client has the cookie, match against the first route.
2. If the request doesn't have a cookie, then match against the second route.
But it doesn't work like that. It matches against `HXRequest :> Get '[HTML] (Partial Home)` whether or not the request has a cookie.
This means I can't represent two pages, one for a non-authenticated users and one for an authenticated users, by the same URL. I want to be able to get to both routes with the same URL `baseUrl/`. Instead, I must add a path in front of the protected route, like `baseUrl/protected/`.
This works fine:
```haskell
Auth '[Cookie] Model.User :> "protected" :> HXRequest :> Get '[HTML] (Partial Home)
```
Is there a way around this? Maybe my Server types aren't structured correctly? If it's not possible I don't want to waste more time on the problem. It's just a slight annoyance.
Contributor guide
Research direction
Start by reproducing the route definitions shown in the issue, comparing the protected and unprotected HomeRoute at the same URL with and without a Cookie. Read the Servant Auth '[Cookie] combinator and route-selection behavior first. Done means determining whether both routes can be selected by cookie presence, or documenting why a distinct path is required.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100