Implement ResourceAdapter abstract methods

[miscampbell]

Hi

Can I propose we remove the abstract methods that are declared on the ResourceAdapter.php class and implement them to return an Exception instead?

My reason for this is to fix the issue when I wished to extend the ResourceAdapter and have requirement for the majority of the methods that are already flagged as abstract.

Let me know your thoughts. Please see example of the type of class declaration I wish to avoid:

class RevokeTokenResourceAdapter extends ResourceAdapter
{
    public function post($payload, $params, WebRequest $request)
    {
        $token = $this->extractAuthorizationToken($request);

        try {
            $apiToken = ApiToken::findFirst(new Equals('Token', $token));
            $apiToken->Expires = new RhubarbDateTime('-10 seconds');
            $apiToken->save();
        } catch (RecordNotFoundException $ex) {
        }

        $response = new \stdClass();
        $response->status = true;

        return $response;
    }

    private function extractAuthorizationToken(WebRequest $request)
    {
        $token = '';
        if (!$request->header("Authorization")) {
            Log::debug("Authorization header missing. If using fcgi be sure to instruct Apache to include this header", "RESTAPI");
            return $token;
        }

        $authString = trim($request->header("Authorization"));

        if (stripos($authString, "token") !== 0 && stripos($authString, "bearer") !== 0) {
            return $token;
        }

        if (!preg_match("/(token|bearer)(=|\s+)\"?([[:alnum:]]+)\"?/i", $authString, $match)) {
            return $token;
        }

        $token = $match[3];

        return $token;
    }

    protected function countItems($rangeStart, $rangeEnd, $params, ?WebRequest $request)
    {

    }

    protected function getItems($rangeStart, $rangeEnd, $params, ?WebRequest $request)
    {

    }

    public function putResource($resource)
    {

    }

    public function makeResourceByIdentifier($id)
    {

    }

    public function makeResourceFromData($data)
    {

    }
}

[samnotsowise]

the idea of the api module is that it gives you a lot of stuff (lists, get/post/put style actions) out of the box in exchange for telling it how you want it to treat your models using ResourceAdapters. If you're not going to use these you probably don't need the api module.

Can I also just ask: are you using bearer auth but not jwts? cause JWT's remove the need for your token table altogether and provide a secure communication mechanism. I'd strongly encourage their use for a new api.

[miscampbell]

Hi @samnotsowise

Sorry I am not proposing to remove the methods just to make them not abstract and make them have a default implementation that throws an exception which would mimic the previous RestResource from v1 and v2. For example

public function putResource($resource)
    {
        throw new RestImplementationException();
    }

Regarding using JWT instead of ApiToken this has not been spec'd for I dont think. Could we grab a chat with yourself and @acuthbert to discuss?

[samnotsowise]

couldn't you just use a URLHandler for this? - i don't see what ResourceAdapters are used for in the module, but it sounds like it's for CRUD style actions for a rest endpoint or something, where you should be implementing those methods or shouldn't be using the solution?

[acuthbert]

Hi guys - yes let's chat tomorrow about this issue and the other in the scaffold, that'll save us all some time. I'm not convinced about the JWTs as there needs to be a mechanism for revoking a token from the server side (say a forced password reset, or user deactivation). Happy to look at options tho.

[samnotsowise]

all you need to force the invalidation of a token is a salt stored per user which is used in the encryption of the JWT. user deactivation isn't really handled by our current token auth process - we currently validate the user linked to the token and that should remain the same when using jwt auth