view release on metacpan or  search on metacpan

lib/CallBackery/Controller/RpcService.pm  view on Meta::CPAN

package CallBackery::Controller::RpcService;

use Mojo::Base qw(Mojolicious::Plugin::Qooxdoo::JsonRpcController),
    -signatures,-async_await;
use CallBackery::Exception qw(mkerror);
use CallBackery::Translate qw(trm);
use Mojo::JSON qw(encode_json decode_json from_json);
use Syntax::Keyword::Try;
use Scalar::Util qw(blessed weaken);

# RPC error code the qooxdoo frontend maps to "session expired -> reload".
# Distinct from code 6 ("login required -> show login dialog").
use constant RPC_SESSION_EXPIRED => 7;

=head1 NAME

CallBackery::RpcService - RPC services for CallBackery

=head1 SYNOPSIS

This module gets instantiated by L<CallBackery> and provides backend
functionality.

=head1 DESCRIPTION

This module provides the following methods

=cut

# the name of the service we provide
has service => 'default';

=head2 allow_rpc_access(method)

Decide whether the current request may invoke C<$method>. Returns C<1> when
access is granted and C<0> when it is refused (the dispatcher turns a C<0> into a
code 6 "access denied" reply, which the frontend maps to the login dialog). When
access is refused specifically because a previously valid session has expired,
this instead C<die>s a code 7 (C<RPC_SESSION_EXPIRED>) exception so the frontend
can prompt a reload rather than a fresh login.

The rules are evaluated in order:

=over

=item *

Non-C<POST> requests are refused (C<return 0>).

=item *

Methods not listed in C<%allow> are refused (C<return 0>).

=item *

Public methods (C<%allow> level C<1>) are always allowed.

=item *

Any authenticated user is allowed. Reading C<isUserAuthenticated> forces the
session cookie to be evaluated, which is also what sets C<sessionExpired> on the
user object.

=item *

Level C<3> methods are additionally allowed for an unauthenticated user when the
target plugin opts into anonymous access (C<mayAnonymous>). The plugin
instantiation is wrapped in C<eval>, because instantiating a plugin as an
unauthenticated user commonly dies (plugins read user rights/config); such a