haskell-servant / haskell-servant/servant
Client implementation for Cookie auth APIs
- Dominant language
- Haskell
- Stars
- 2k
- Forks
- 427
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 5
Description
I'm currently experimenting with servant-auth and Cookie based authentication and I would like to write a test for such an API using servant-client.
I have the following API definition:
```hs
type Unprotected =
"login"
:> ReqBody '[FormUrlEncoded] Login
:> Verb 'POST 204 '[JSON] (Headers '[Header "Set-Cookie" SetCookie, Header "Set-Cookie" SetCookie] NoContent)
type Logout = "logout" :> Get '[JSON] (Headers '[Header "Set-Cookie" SetCookie, Header "Set-Cookie" SetCookie] String)
type Protected = "name" :> Get '[JSON] String
type AuthAPI = (Servant.Auth.Server.Auth '[Cookie] User :> Protected) :<|> Unprotected :<|> Logout
```
which is supposed to model a form-based login, logout and a protected resource.
This is all fine and works as intended. If I now try and generate client functions, it doesn't compile:
```hs
_ = client (Proxy :: Proxy AuthAPI)
```
```
Error: • No instance for (HasClient
ClientM (Auth '[Cookie] User :> Protected))
arising from a use of ‘client’
• In the expression: client (Proxy :: Proxy AuthAPI)
In a pattern binding: _ = client (Proxy :: Proxy AuthAPI)
|
17 | _ = client (Proxy :: Proxy AuthAPI)
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
```
I found out that servant-auth-client- only supports JWT and basic auth, so it probably isn't what I can use here. I'm also aware that there's ongoing discussion in #1484, but to be honest I'm a bit lost in the details and don't know how to proceed here. Is that something that is supported? Or will it be supported in the future? Or do I have to provide my own implementation for a `HasClient` instance?
I have a minimal working example for that [here](https://github.com/L7R7/haskell-incubator/tree/main/polysemy-servant). It also includes a test, so you can see the compile error [here](https://github.com/L7R7/haskell-incubator/runs/5246058721?check_suite_focus=true) as well.
Contributor guide
Research direction
Start with the servant-client entry point, `client (Proxy :: Proxy AuthAPI)`, and the missing `HasClient ClientM (Auth '[Cookie] User :> Protected)` instance. Review the linked minimal working example and the discussion in #1484 to understand how Cookie authentication should be represented. Done means the AuthAPI client compiles and the included test can exercise the protected endpoint.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100