class PerlAuthTagger

• PerlAuthTagger
• FrameworkTagger
• Tagger
• Reference
• Object

Overview

Identifies authentication / authorization guards in Perl web apps.

Dancer2 leans on Dancer2::Plugin::Auth::Extensible, which guards routes either inline on the declaration:

get '/admin' => require_role Admin => sub { ... }; get '/me' => require_login sub { ... };

or globally through a hook before that calls logged_in_user / redirect. Catalyst and Mojolicious use handler-body checks ($c->user_exists, $c->assert_user_roles, $c->require_login, $self->is_user_authenticated). This tagger surfaces all of them as a single auth tag so reviewers can spot the unprotected routes.

Defined in:

Constant Summary

BODY_PATTERNS = [{/\blogged_in_user\b/, "Dancer2 logged_in_user"}, {/\buser_has_role\b/, "Dancer2 user_has_role"}, {/\bauthenticate_user\b/, "Dancer2 authenticate_user"}, {/->\s*assert_user_roles\b/, "Catalyst assert_user_roles"}, {/->\s*check_user_roles\b/, "Catalyst check_user_roles"}, {/->\s*user_exists\b/, "Catalyst user_exists"}, {/\$c\s*->\s*require_login\b/, "Catalyst require_login"}, {/\$c\s*->\s*authenticate\b/, "Catalyst authenticate"}, {/->\s*is_user_authenticated\b/, "Mojolicious is_user_authenticated"}]

Checks that appear inside the handler body (or a nearby helper).

GLOBAL_GUARD_BLOCK_START = /\bhook\s+before\b|\bbefore\s*=>\s*sub\b|\bsub\s+auto\b|\bsub\s+begin\b/

GLOBAL_GUARD_KEYWORDS = /\brequire_login\b|\brequire_role\b|\blogged_in_user\b|\buser_has_role\b|->\s*authenticate\b|->\s*user_exists\b|->\s*require_login\b|redirect\b.*\blogin\b/

Keywords that make a hook before / Catalyst sub auto block an application-wide guard covering every route in the file.

ROUTE_WRAPPER_PATTERNS = [{/\brequire_all_roles\b/, "Dancer2 require_all_roles"}, {/\brequire_any_role\b/, "Dancer2 require_any_role"}, {/\brequire_role\b/, "Dancer2 require_role"}, {/\brequire_login\b/, "Dancer2 require_login"}]

Inline route wrappers from Dancer2::Plugin::Auth::Extensible. These sit between the path and the sub { ... } on the route declaration.

Constructors

• .new(options : Hash(String, YAML::Any))

Class Method Summary

• .target_techs : Array(String)

Instance Method Summary

• #perform(endpoints : Array(Endpoint)) : Array(Endpoint)

Constructor Detail

Class Method Detail

Instance Method Detail