Coast uses a role concept to control access to different Web pages.
This recipe describes how a special login page is created and how Coast
needs to be setup for the enforcement of the necessary role exchanges.
(CAUTION: Conceptually Roles are linearly ordered. This implies that the action map of a higher level Role must be a superset of the maps of all lower level Roles, i.e. all actions that are handled by a lower level Role need to be handled by a higher level Role.)
[[#wd DisplayAnythingRenderer { /AnythingInfo { "/Roles {" " /Guest {" " "Default"" " }" "}" } }]](Because of our examples 1 and 2 it's in our application /Role instead of /Guest.)
[[#wd DisplayAnythingRenderer { /AnythingInfo { "/GuestRole 0" "/CustomerRole 1" } }]]
[[#wd DisplayAnythingRenderer { /AnythingInfo { "/RoleChanges {" " /LoginOk "CustomerRole"" " /Logout "GuestRole"" "}" } }]]The special action LoginOk is used to enter role CustomerRole. (This action is typically generated by some program code (see later). Reversely a Logout action is used to leave the privileged CustomerRole role.
Notice: A Logout action may be generated by the Coast framework. Logout therefore usually belongs into every action/page map!
A Logout action may also be used directly for a 'Sign off' link/button embedded into any page. The renderer specification for a Logout link might look like this:
[[#wd DisplayAnythingRenderer { /AnythingInfo { "/LogoutLink {" " /Link {" " /Action "Logout"" " /Label {" " /String {" " /Default "Logout"" " }" " }" " }" "}" } }]]
Example: In our application the page Ex3Page is used to sign on. The page is designed to contain two input fields: one for the user name and another one for the password. Upon submission of the input a MyDoCheckPassword is triggered (Some code for MyDoCheckPassword Action is used to check the password... see later).
Ex3Page uses the file Ex3Page.html for the general layout of the page. This is a section of this template file:
[[#wd DisplayAnythingRenderer { /AnythingInfo { "..." "User: [[#wd Lookup NameField ]]" "Password: [[#wd Lookup PasswordField ]]" "<center>[[#wd Lookup SubmitButton ]]</center>" "..." } }]]The referenced building blocks have to be defined in Ex3Page.any:
[[#wd DisplayAnythingRenderer { /AnythingInfo { "/Body {" " /Form {" " /Method "POST"" " /Action "MyDoCheckPassword"" " /TemplateName "Ex3Page"" " }" "}" " " "/NameField {" " /Text {" " /Name "resultLoginName"" " /Value "lookupLoginDefault"" " /Size 16" " }" "}" " " "/PasswordField {" " /Text {" " /Name "resultPassword"" " /Value "lookupPasswdDefault"" " /Unreadable 1" " /Size 16" " }" "}" " " "/SubmitButton {" " /Button {" " /Name "submit"" " /Label {" " /String {" " /Default " Login "" " }" " }" " }" "}" } }]]Reminder: Upon clicking on the 'Login' button, the FORM sends all the contents of the input fields including a MyDoCheckPassword action.
Important: Coast automatically generates a 'Login' action whenever a user needs to authenticate - because the level of his role is too low. All action/page maps therefore should always contain a /Login entry that points to a login page.
Example: The /Login entry has to be added to the maps of GuestRole and CustomerRole.
[[#wd DisplayAnythingRenderer { /AnythingInfo { "/Map {" " /Default {" " ..." " /Login "Ex3Page"" " ..." " }" "}" } }]]
Example: Some code for MyDoCheckPassword needs to be written - so as to decide if a role change is allowed.
[[#wd DisplayAnythingRenderer { /AnythingInfo { "bool MyDoCheckPassword::DoAction(String &action, Context& c)" "{" " Anything fields = c.GetQuery()["fields"];" " " " // make the needed checks" " String name = fields["resultLoginName"].AsString("");" " String password = fields["resultPassword"].AsString("");" " " " if ( password == "xy" ) {" " action = "LoginOk";" " }" " else {" " action = "LoginFailed";" " }" " return true;" "}" } }]]Notice: Of course the action "LoginFailed" also needs to be added to the action/page maps (Unless an action that already existed was chosen.)
There are advanced issues with regard to access control that were not covered in this example.
setup of Roles, setup of Pages, Actions in Links/Forms, using Forms&Fields, writing actions, advanced access control (different Customers), action/page map (what are the minimal actions to support... framework generated actions...)