apiWork.scala

case class KeymasterPostLoginFilter(store: SessionStore)(implicit secretStoreApi: SecretStoreApi)
      extends Filter[SessionIdRequest, Response, IdentifyRequest[Auth], IdentifyResponse[Tokens]] {
    def apply(req: SessionIdRequest,
              service: KeymasterIdentityProvider[IdentifyRequest[Auth], IdentifyResponse[Tokens]]): Future[Response] = {
        for {
          // this is where a `map would be nice on IdentifyRequest
          // it would just look like `req.map(auth => transform(BasicRequest))`
          // which we could expose via the IdentityService as a `.to[A]` method which calls the `map`
          // so it would be `service.requestTo[BasicRequest](req)`
          // anyway, using the `.transform` method, it should look like this:
          transformed <- req.req.serviceId.loginManager.proto match {
            case Basic => service.transform(BasicRequest(req))
            case OAuth2 => service.transform(OAuth2Request(req))
            case _ => service.transform(NoAuth(req)) // a special ADT
          }
          tokenResponse <- {println("***MVK: transformed = " + transformed); service(KeymasterIdentifyReq(transformed))}
          session <- Session(tokenResponse.identity.id, AuthenticatedTag)
          _ <- store.update[Tokens](session)
          originReq <- getRequestFromSessionStore(req.sessionId)
          _ <- store.delete(req.sessionId)
        } yield tap(Response(Status.Found))(res => {
          res.location = originReq.uri
          res.addCookie(session.id.asCookie)
        })//)
    }