{"action":"created","issue":{"url":"https://api.github.com/repos/line/armeria/issues/328","repository_url":"https://api.github.com/repos/line/armeria","labels_url":"https://api.github.com/repos/line/armeria/issues/328/labels{/name}","comments_url":"https://api.github.com/repos/line/armeria/issues/328/comments","events_url":"https://api.github.com/repos/line/armeria/issues/328/events","html_url":"https://github.com/line/armeria/pull/328","id":187908483,"number":328,"title":"Implement HTTP authorization decorator service + Rate-limiting decorator service","user":{"login":"dongjinleekr","id":2375128,"avatar_url":"https://avatars.githubusercontent.com/u/2375128?v=3","gravatar_id":"","url":"https://api.github.com/users/dongjinleekr","html_url":"https://github.com/dongjinleekr","followers_url":"https://api.github.com/users/dongjinleekr/followers","following_url":"https://api.github.com/users/dongjinleekr/following{/other_user}","gists_url":"https://api.github.com/users/dongjinleekr/gists{/gist_id}","starred_url":"https://api.github.com/users/dongjinleekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dongjinleekr/subscriptions","organizations_url":"https://api.github.com/users/dongjinleekr/orgs","repos_url":"https://api.github.com/users/dongjinleekr/repos","events_url":"https://api.github.com/users/dongjinleekr/events{/privacy}","received_events_url":"https://api.github.com/users/dongjinleekr/received_events","type":"User","site_admin":false},"labels":[{"id":287373881,"url":"https://api.github.com/repos/line/armeria/labels/new%20feature","name":"new feature","color":"009800","default":false}],"state":"open","locked":false,"assignee":{"login":"trustin","id":173918,"avatar_url":"https://avatars.githubusercontent.com/u/173918?v=3","gravatar_id":"","url":"https://api.github.com/users/trustin","html_url":"https://github.com/trustin","followers_url":"https://api.github.com/users/trustin/followers","following_url":"https://api.github.com/users/trustin/following{/other_user}","gists_url":"https://api.github.com/users/trustin/gists{/gist_id}","starred_url":"https://api.github.com/users/trustin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trustin/subscriptions","organizations_url":"https://api.github.com/users/trustin/orgs","repos_url":"https://api.github.com/users/trustin/repos","events_url":"https://api.github.com/users/trustin/events{/privacy}","received_events_url":"https://api.github.com/users/trustin/received_events","type":"User","site_admin":false},"assignees":[{"login":"trustin","id":173918,"avatar_url":"https://avatars.githubusercontent.com/u/173918?v=3","gravatar_id":"","url":"https://api.github.com/users/trustin","html_url":"https://github.com/trustin","followers_url":"https://api.github.com/users/trustin/followers","following_url":"https://api.github.com/users/trustin/following{/other_user}","gists_url":"https://api.github.com/users/trustin/gists{/gist_id}","starred_url":"https://api.github.com/users/trustin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trustin/subscriptions","organizations_url":"https://api.github.com/users/trustin/orgs","repos_url":"https://api.github.com/users/trustin/repos","events_url":"https://api.github.com/users/trustin/events{/privacy}","received_events_url":"https://api.github.com/users/trustin/received_events","type":"User","site_admin":false}],"milestone":null,"comments":17,"created_at":"2016-11-08T05:57:15Z","updated_at":"2016-12-02T05:51:15Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/line/armeria/pulls/328","html_url":"https://github.com/line/armeria/pull/328","diff_url":"https://github.com/line/armeria/pull/328.diff","patch_url":"https://github.com/line/armeria/pull/328.patch"},"body":"Hello. Here is a concept-proof commit which resolves #259 and #258.\r\n\r\nHere is my approach: Http Authorization routine, including rate-limiting routine, can be represented in the form of Predicate of Authorization Token with its internal state (e.g., Set of valid tokens, API usage rate, etc.). So, I implemented a helper method in HttpAuthSevice which creates DecoratingServiceFunction<HttpRequest, HttpResponse> with given Predicate. For example, HttpAuthService#basic returns a DecoratingServiceFunction which inspects authorization header and handle the request to delegate.\r\n\r\nThis commit only includes basic authorization. If you agree with my approach, I will continue on the other authorization methods like Oauth1.0a, Oauth2, and so on. Thanks."},"comment":{"url":"https://api.github.com/repos/line/armeria/issues/comments/264379267","html_url":"https://github.com/line/armeria/pull/328#issuecomment-264379267","issue_url":"https://api.github.com/repos/line/armeria/issues/328","id":264379267,"user":{"login":"trustin","id":173918,"avatar_url":"https://avatars.githubusercontent.com/u/173918?v=3","gravatar_id":"","url":"https://api.github.com/users/trustin","html_url":"https://github.com/trustin","followers_url":"https://api.github.com/users/trustin/followers","following_url":"https://api.github.com/users/trustin/following{/other_user}","gists_url":"https://api.github.com/users/trustin/gists{/gist_id}","starred_url":"https://api.github.com/users/trustin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trustin/subscriptions","organizations_url":"https://api.github.com/users/trustin/orgs","repos_url":"https://api.github.com/users/trustin/repos","events_url":"https://api.github.com/users/trustin/events{/privacy}","received_events_url":"https://api.github.com/users/trustin/received_events","type":"User","site_admin":false},"created_at":"2016-12-02T05:51:15Z","updated_at":"2016-12-02T05:51:15Z","body":"> Only OAuth1a has the concept of signature. But it also has no concept of default signature method - As far as I know, the most widely used method is HMAC-SHA1 (e.g., Twitter) which was also documented as an example of signature method in official documentation. But if we support verification for this method only, it would also be a little bit weird.\r\n\r\nI think it's fine as long as a user can implement his/her own mechanism. What's important is to provide the implementation for the most widely adopted one.\r\n\r\n> Then, How about replace the (BasicToken) password / (OAuth1aToken) signature / (OAuth2) access token into asterisk ()? ex) \"Deep Thought\" -> \"*********\" \"42\" -> \"\"\r\n\r\nYes. Also, please keep in mind we should use fixed-length asterisks so that nobody can guess the length of the password. How about just four asterisks?"}}
{"actor":{"display_login":"trustin"}}