SnowAuthRequestWithSimpleRestSecurity.java

@Singleton
public class AppAuthRequest implements AuthRequest<User>{

    @Inject
    private UserDao userDao;
    
    @Override
    public AuthToken<User> authRequest(RequestContext rc) {
        AuthToken<User> authToken = null;
        
        //TODO: here get the various user tokens (here just get the username)
        String username = rc.getCookie("username");
        
        WebRequestType wrt = rc.getWebRequestType();
        
        switch(wrt){
            
            // we always allow any static files and generated assets
            case GENERATED_ASSET:
            case STATIC_FILE:
                break;
                
            // We authenticate for template and rest calls
            case WEB_TEMPLATE:
            case WEB_REST:
                if (!Strings.isNullOrEmpty(username)){
                    User user = userDao.getByUsername(username);
                    //TODO: here do token validation. Right now, just passthrough
                    if (user != null){
                        authToken = new AuthToken<User>();
                        authToken.setUser(user);
                        return authToken;
                    }
                }
                break;
                
            default:
                break;
        }
        
        // We block "unauthenticated" calls for any rest API calls except login
        if (authToken == null && wrt == WebRequestType.WEB_REST  && !"/login".equals(rc.getResourcePath()) ){
            throw new AbortWithHttpStatusException(HttpStatus.FORBIDDEN);
        }
        
        return authToken;
    }

}