Adding a header to a smithy client request?

[Quafadas]

I've written my IDL; generated an http client... to be able to use it to contact our internal services, I'd need to be to able to add a header along the lines of;

Authorization: Bearer $token

Schematically...

resource.use {client => client.lovelyTypesafeTransportNoAuthAuth() }

It wasn't obvious to me, how I would do this or where the right insertion point might be?

[daddykotex]

Hey @Quafadas , good to see you here again. Hopefully, I'm able to help.

For more info on why we don't have out-of-the-box support for authentication, see #127. In the meantime, I'll provide you with a way to write a http4s middleware to tweak your http4s client to add the headers, it should be relatively simple.

---

Updated:

Relevant bits:

  // client middleware
  val authMiddleware: org.http4s.client.Middleware[IO] = { client =>
    Client { req =>
      client.run(
        req.withHeaders(
          headers.Authorization(Credentials.Token(AuthScheme.Bearer, "TOKEN"))
        )
      )
    }
  }

  val client = EmberClientBuilder.default[IO].build.map { client =>
    SimpleRestJsonBuilder(HelloWorldService)
      .clientResource(
        authMiddleware(client),
        Uri.unsafeFromString("http://some-api.com")
      )
  }

In http4s, a client is just a function from a Request to a F[Response]. And a middleware is a function that takes a client and returns another client. The idea is to use the client you receive as an argument to implement the new client. Your new implementation adds the headers. See the whole project here: https://github.com/daddykotex/smithy4s-client-middleware

Note, I did compile it, but I did not run it! Hope it works out for you.

[Quafadas]

As always, thanks very much for the response! Discussion looks pretty reasonable.

Let me have a play with this;

First approach

The first way is to disable the Danger diagnostic associated with the attempting to set a header to Authorization. You can disable it by adding this at the top of the file :

metadata suppressions = [
{
id: "HttpHeaderTrait",
namespace: "my.namespace",
reason: "I really want to use discouraged headers"
}
]

tomorrow.... my use cases are pretty simple - so I'm fine with the pollution!

[Quafadas]

Or this would be great too! It's a much more general (better!) solution, obviously, but there's no pressure - I'm still having a blast with smithy either way around!

http4s middleware to tweak client

[Quafadas]

So... I had a bit of an odyessy, but I think i got it working... I ended up doing this, not at all sure that it's the "right" strategy, per se.

def getToken: IO[String] = ???

  val vanillaClient: Resource[IO, Client[IO]] =
    EmberClientBuilder.default[IO].build

  def authMiddleware(inTok: String): org.http4s.client.Middleware[IO] = { (client: Client[IO]) =>
    Client { req =>
      client.run(
        req.withHeaders(
          headers.Authorization(Credentials.Token(AuthScheme.Bearer, inTok))
        )
      )
    }
  }

  def ilsopClient(
      client: Client[IO],
      token: String,
      stub: String
  ): Resource[IO, IlsopWrapperService[IO]] =
    IlsopWrapperService.simpleRestJson.clientResource(
      authMiddleware(token)(client),
      Uri.unsafeFromString(stub)
    )

  def authdClient: Resource[cats.effect.IO, IlsopWrapperService[cats.effect.IO]] =
    val conf                                                = Resource.eval(config)
    val t: Resource[cats.effect.IO, String]                 = Resource.eval(getToken)
    val c: Resource[cats.effect.IO, Client[cats.effect.IO]] = vanillaClient
    val resourced = for {
      token  <- t
      client <- c
      conf0  <- conf
    } yield {
      println(conf0.stub)
      ilsopClient(client, token, conf0.stub)
    }
    resourced.flatten

// Using it... 
  override def getCfn(id: ju.UUID): IO[SingleNetworkExport] =
    authdClient.use(il => il.getCfn(id))

It feels kind of messy, but it does something, so I'll roll with that. Using it afterwards is a pleasent experience :-)!

[Baccata]

The code's aesthetics could be change for it to feel less messy, but the idea and implementation seem very correct and are the right way to go a it :)

[Quafadas]

Yes, I guess I'm trying to learn cats effect by tossing myself into it and seeing how it goes. I've been posting up on discord too...

... yours are not the first pair of eyeballs to have been damaged today :-D!

[Quafadas]

After some evolution, I ended here:

case class IlsopLoginConfig(
    username: String,
    password: Secret[String],
    clientId: String,
    scope: String,
    grantType: String,
    login_url: String,
    stub: String,
    cacheString: String = "ilsop_token"
)

case class AuthResponseIlsop(
    access_token: String,
    expires_in: Int,
    token_type: String,
    scope: String
) derives Encoder.AsObject,
      Decoder

def sLog(s: String) = scribe.cats.io.debug(s)

object IlsopClientBuilder:

  private inline def loginRequest(inline ilsopConfig: IlsopLoginConfig): Request[IO] =
    Request(
      POST,
      Uri.unsafeFromString(ilsopConfig.login_url),
      headers = Headers("Content-Type" -> "application/x-www-form-urlencoded")
    ).withEntity(
      UrlForm(
        "client_id" -> ilsopConfig.clientId,
        "scope" -> ilsopConfig.scope,
        "grant_type" -> ilsopConfig.grantType,
        "password" -> ilsopConfig.password.value,
        "username" -> ilsopConfig.username
      )
    )

  inline def authdClient(
    inline ilsopConfig: IlsopLoginConfig,
    inline tokenCache: MemoryCache[IO, String, String],
    inline client: Client[IO]): Client[IO] =
    val middleware = authMiddleware(getIlsopToken(tokenCache, client, makeLoginRequest(ilsopConfig), ilsopConfig ))
    middleware(client)


  inline def forService[Alg[_[_, _, _, _, _]], Op[_,_,_,_,_]](
    inline serviceDef: Service.Mixin[Alg, Op],
    inline ilsopConfig: IlsopLoginConfig,
    inline tokenCache: MemoryCache[IO, String, String],
    inline client: Client[IO],
    inline maxArity : Int = 100001
  ): Alg[[I, E, O, SI, SO] =>> IO[O]] =
    SimpleRestJsonBuilder
      .withMaxArity(maxArity)
      .apply[Alg](serviceDef)
      .client(authdClient(ilsopConfig, tokenCache,client))
      .uri(Uri.unsafeFromString(ilsopConfig.stub))
      .make
      .fold(throw _, identity)

  private inline def makeLoginRequest(ilsopConfig: IlsopLoginConfig): Client[IO] => IO[AuthResponseIlsop] = (client:Client[IO]) => client.expect[AuthResponseIlsop](loginRequest(ilsopConfig))

  private def getIlsopToken(tokenCache: MemoryCache[IO, String, String], client: Client[IO],makeLoginRequest: Client[IO] => IO[AuthResponseIlsop], ilsopConfig: IlsopLoginConfig): IO[String] =
    val tokenIO = tokenCache.lookup(ilsopConfig.cacheString)
    tokenIO.flatMap {
      _ match
        case None =>
          makeLoginRequest(client).flatMap(in =>
            val t = in.access_token
            val timeout = in.expires_in - 1
            val dur = TimeSpec.fromDuration(Duration(timeout, java.util.concurrent.TimeUnit.SECONDS))
            sLog("Insert token in cache, timeout in ") >>
              tokenCache.insertWithTimeout(dur)("ilsop_token", t).as(t)
          )
        case Some(t) =>
          sLog("retrieve token from cache") >>
            IO.pure(t)
    }
  end getIlsopToken

  inline def authMiddleware(inline inTok: IO[String]): org.http4s.client.Middleware[IO] = (client: Client[IO]) =>
    val asRes = Resource.eval(inTok)
    Client { req =>
      asRes.flatMap(s =>
        client.run(
          req.withHeaders(
            req.headers ++ Headers(Authorization(Credentials.Token(AuthScheme.Bearer, s)))
          )
        )
      )
    }

end IlsopClientBuilder

Which is then very neat at the callsite.

IlsopClientBuilder.forService(IlsopService, config0, cache, client)

My own use case is that I have lots of (different) internal services, which all have the same login mechanism. This makes it easy to instantiate a bunch of clients that may choose to share logins and tokens depending on config.

Tokens are cached for the duration of their validity, which hopefully means not continually repeating login requests.