Track UI is so cool. Thanks you showed it to me.

How can I know decision: authorized? true use :authorized key under the hood?

Oh, sorry, I had a typo earlier I always ment to write :authorized?

oh ok

What about fn like :as-response? Are there more of them?

I mean this fn is not listed anywhere in Actions, Decisions, Hanlders etc.

But fn is useful

(resource {:allowed-methods [:post :options]
                       :available-media-types ["application/edn" "application/json"]
                       :handle-options (fn [_]
                                         (ring-response {}))
                       :handle-created (fn [{:keys [request] :as ctx}]
                                         (let [{:keys [params]} request
                                               {:keys [query]} params]
                                           (ring-response
                                             {:status 200
                                              :body (when query (lacinia/execute foo/schema query nil nil))})))
                       :as-response (fn [d ctx]
                                      (-> (as-response d ctx)
                                          (assoc-in [:headers "Access-Control-Allow-Origin"] "*")
                                          (assoc-in [:headers "Access-Control-Allow-Headers"] "Content-Type")))})

without this key, as-reponse is not run 😕

because :handle-options is nil

I guess it should because :options is in allowed-methods

Hmm according to https://github.com/clojure-liberator/liberator/blob/f6e3c7bce4d368e6b17e55076ff4f7a551190083/test/test_override_as_response.clj#L40-L45 it can be a bug.

From tests it sounds like :as-response should work without :handle-options

@kwladyka I will look into that tomorrow

thank, at that moment I have this:

(resource {:allowed-methods [:post :options]
                              :new? false
                              :handle-options (constantly (ring-response {:status 401}))
                              :handle-no-content (fn [{:keys [request] :as ctx}]
                                                   (let [{:keys [params]} request
                                                         {:keys [email password]} params]
                                                     (if-let [uuid (auth/?login->uuid email password)]
                                                       (ring-response {:session {:uuid uuid}})
                                                       (ring-response {:status 401
                                                                       :session nil}))))})

I am working on graphql response now

(def handler-map
  {:not-found (constantly (not-found "404 not found"))
   ;; authentication - only for web browser users from our domains
   :authentication (resource {:allowed-methods [:post :options]
                              :new? false
                              :handle-options (constantly (ring-response {:status 204}))
                              :handle-no-content (fn [{:keys [request] :as ctx}]
                                                   (let [{:keys [params]} request
                                                         {:keys [email password]} params]
                                                     (if-let [uuid (auth/?login->uuid email password)]
                                                       (ring-response {:session {:uuid uuid}})
                                                       (ring-response {:status 401
                                                                       :session nil}))))})
   ;; public API, authentication and authorization by token or session
   :graphql (resource {:allowed-methods [:post :options]
                       :available-media-types ["application/edn" "application/json"]
                       :handle-options (constantly (ring-response {:status 204}))
                       :authorized? (fn [{:keys [request] :as ctx}]
                                      (let [{:keys [session headers]} request
                                            {:keys [uuid]} session
                                            {:strs [authorization]} headers
                                            token (some->> authorization
                                                           (re-matches #"(?i)Bearer\s([\d|a-f]{8}-(?:[\d|a-f]{4}-){3}[\d|a-f]{12})")
                                                           (second))]
                                        (or (auth/?token->uuid token)
                                            (auth/uuid-exist? uuid))))
                       :new? false
                       :respond-with-entity? true
                       :handle-ok (fn [{:keys [request] :as ctx}]
                                    (let [{:keys [params]} request
                                          {:keys [query]} params]
                                      (ring-response
                                        {:body (when query (lacinia/execute graphql/schema query nil nil))})))
                       :as-response (fn [d ctx]
                                      (-> (as-response d ctx)
                                          (assoc-in [:headers "Access-Control-Allow-Origin"] "*")
                                          (assoc-in [:headers "Access-Control-Allow-Headers"] "Content-Type")))})})

But probably I will have to move :authorized? to :handle-ok, because I have to get this token once again there or get uuid from session

Unless there is a way to inject uuid to :handle-ok