如何使用shelf_auth庫驗證已建立的會話？

Question

我一直在試圖編寫一個接受用戶名/密碼憑證的簡單服務器，驗證它們，然後爲客戶端創建一個JWT令牌，然後用它們訪問某些路由。我能夠完成所有工作，直到在服務器端接收並驗證客戶端的JWT。

void main() { 
//use Jwt based sessions and create the secret using a UUID 
JwtSessionHandler sessionHandler = 
    new JwtSessionHandler('ffl_sales_server', new Uuid().v4(), 
    auth.lookupByUsername); 

    //allow http for testing with curl, do not use in production 
    bool allowHttp = true; 

    final Map<String, String> headers = 
    {'Access-Control-Allow-Origin': 'http://192.168.100.83:3030', 
    "Access-Control-Expose-Headers": "Authorization", 
    "Access-Control-Allow-Credentials" : "true", 
    "Access-Control-Allow-Headers" : "Authorization"}; 

    //fix the cors headers 
    Response options(Request request) => (request.method == 'OPTIONS') ? 
     new Response.ok(null, headers: headers) : null; 
    Response cors(Response response) => 
     response.change(headers: headers); 
    Middleware fixCors = createMiddleware(requestHandler: options, 
     responseHandler: cors); 

    // authentication middleware for a login handler (post) 
    Middleware loginMiddleware = authenticate(
     [new UsernamePasswordAuthenticator(lookupByUsernamePassword)], 
     sessionHandler: sessionHandler, allowHttp: allowHttp, 
     allowAnonymousAccess: false); 

    // authentication middleware for routes other than login that 
    // require a logged in user 
    // here we are relying solely on users with a session established 
    // via the login route 
    Middleware defaultAuthMiddleware = authenticate(
     [],sessionHandler: sessionHandler, allowHttp: true, 
     allowAnonymousAccess: false); 

    Router rootRouter = router(handlerAdapter: handlerAdapter()); 

    //the route where the login credentials are posted 
    rootRouter.post('/login', (Request request) => new Response.ok('SUCCESS'), middleware: loginMiddleware); 

    //the routes which require an authenticated user 
    rootRouter.child('/authenticated', 
     middleware: defaultAuthMiddleware) 
    ..add('/users', ALL_METHODS, new Users(_connection).handle) 
    ..add('/stores', ALL_METHODS, new Stores(_connection).handle) 
    ..add('/departments', ALL_METHODS, new Departments(_connection).handle) 
    ..add('/invoices', ALL_METHODS, new Invoices(_connection).handle) 
    ..add('/reports', ALL_METHODS, new Reports(_connection).handle) 
    ..add('/imports', ALL_METHODS, new Imports(_connection).handle) 
    ..add('/vendors', ALL_METHODS, new Vendors(_connection).handle) 
    ..get('/foo', (Request request) => 
     new Response.ok("Doing foo as ${loggedInUsername(request)}\n")); 

    printRoutes(rootRouter); 

    Handler handler = const Pipeline() 
     .addMiddleware(fixCors) 
     .addMiddleware(logRequests()) 
     .addMiddleware(exceptionResponse()) 
     .addHandler(rootRouter.handler); 

    shelf_io.serve(handler, '127.0.0.1', '8080').then((server){ 
    print('Serving as http://${server.address.host}:${server.port}'); 
    }); 
} 

我知道我可能失去了一些東西簡單，但好像我應該有某種形式的處理程序在創建該defaultAuthMiddleware的身份驗證（）函數的第一個參數。我錯過了什麼？

Answer 1

看起來問題出在我的Auth類中。 lookupByUsername函數根本找不到經過身份驗證的用戶，因爲lookupByUsernamePassword函數由於我的疏忽而將其存儲在函數作用域而不是類作用域中。

感謝您的幫助！

Answer 2

我認爲你需要的sessionMiddleware傳遞到其他路線一樣

..add('/invoices', ALL_METHODS, new Invoices(_connection).handle, 
    middleware: defaultAuthMiddleware) 

也許有更好的方法，但是這是我發現我的設置，其中能正常工作的主要區別。