stormpath/stormpath-sdk-node — pull request #41 by robertjd (2014-06-11 21:16:42+00:00)
Title: Api Key Authentication support DRAFT

I’m opening this PR to get some initial feedback on design and feature-complete-ness. In here you will find:

* Create Api Keys through an `Account` instance
* Get Api Keys through an `Account` instance or `Application` instance
* Encrypted caching of Api Keys in the Cache
* Fixing the Cache to make use of regions
* Api Key request authentication via `Application.authenticateApiRequest`, supporting:
* Basic Auth with Api Key credentials
* Exchange Basic Auth credentials for an Oauth token
* Validate a previously issued Oauth token
* Set custom scope and ttl when issuing Oauth tokens
* Read custom scope from previously issued Oauth tokens

As you review `Application.authenticateApiRequest` you will want to read this example app here, specifically this example route handler that would make use of the method:

https://github.com/robertjd/customerapi/blob/master/server.js#L5

Some discussion points:
* There isn't a separate `authenticateOauthRequest` method, though `authenticateApiRequest` does return object types that correlate with the kind of authentication that occurred. Though I didnt need to make use of that in my sample app, merely knowing if the user was asking for a token or not (by inspecting the request uri) was enough context.

* `ApiAuthRequestError` is pretty generic, and leaves it up to the end user to decide how to represent the error as a response (e.g. 500 or 401)

* I am not dealing with reading the request body in `authenticateApiRequest`, I expect that a framework has already parsed the body (see related todo below)

Todos:

* Rework `Application.authenticateApiRequest` to inspect `req.body` OR `req.params`, as these are the most common properties that are created by frameworks. I would also like to make this function a bit more readable.
* Unit and IT tests for `Application.authenticateApiRequest`
* Docs