t2v/play20-auth — pull request #18 by tl1 (2012-11-03 14:33:53+00:00)
Title: Change in authorizedAction to skip body parsing in case authorization fails

Hi there,

first thanks for providing the play20-auth module, it looks pretty neat!

I realized the following when play!ing around with the module: Currently the authorization will happen after the body of a request has been parsed by the action's BodyParser. This can lead to problems as in some cases there is already some kind of logic implemented in the BodyParser. Think about a BodyParser using an Iteratee that directly streams the incoming request data to some other system.

I patched the authorizedAction function so that the authorization will decide over what kind of Iteratee to use within the BodyParser. In case the authorization is successful the Iteratee of the original BodyParser will be used. In case the authorization fails a Done Iteratee will be used skipping all input and directly returning the PlainResult obtained from the authorized function.

Tests pass, so I assume the patch works. However there is one flaw in the solution: The authorized function must be called a second time in case of successful authentication in order to be able to pass the User to the Action. I did not find a better solution for this situation then calling authorized again, maybe you find something better.

Regards,

Tilman