@jmckitrick I think they should be handled in the web-tier. But should the auth-related restructurings be shipped with c-api? I’m not sure. There is already things like :components, which were helpers for request-based Component injection. Not sure if anyone uses that anymore as one can inject components/system via closure into a route tree. Much more explicit.

But, I don’t have a answer yet, so open to suggestions. Options would be: 1) integrate buddy into c-api, add new keys into the core to easily restructure things &/ guard routes like :current-user, :auth-rules etc + api-level options for different auth-mechanisms 2) do examples how-to do these in the client side (as you have done, BIG thanks!!!!) 3) use more standard extensions like middleware to do this:

(context "/admin" []
   :middleware [[wrap-require-roles #{:admin}]]
   :description "only admins see these routes"
   ...)

What do you think would be best?

Hmm, that’s a good question. I’d imagine the less-integrated approach is better, with people still having a choice of authentication libraries.

I’m going to add some more to the auth page of the wiki today.

@ikitommi ^

any good ways of disabling swagger-documentation in production environment?

@jooivind it’s just data, so you can set the :swagger to nil:

(defn app [{:keys [dev?]}]
  (api
    {:swagger 
      (if dev? {:spec "/swagger.json", :ui "/api-docs"}})
    ...))

@ikitommi What helped you get to the level of meta-programming you use in compojure-api ?

I tried to add swagger support to Spray (a functional Scala web framework) but I coudn’t - just too hard. I was determined that it’s easier with Clojure. Not sure it was, but got it working in the end. Lot of learning macros.

oh, it’s over 4 years old now.

I’ve done a decent amount of Common Lisp macros, but not Clojure. Yet. And I’m working on the first Clojure projects in a Scala shop 😉

@ikitommi I think middleware is the best approach for authentication, since it’s consistent with ring’s approach. But I’ve not tried the other approach you suggested, with closures into a route tree. Do you have an example?