Authorization & middlewares

[yallxe]

Hi, first of all thanks for this library and for sipgo a lot.

My question is, will there be middlewares (and maybe builtin auth support) in the library? If so, how would it look in your mind, and do you accept PRs for the project?

[emiago]

hi @yallxe thanks.

I just pushed digest auth server support.
I am not fan and throwing middleware styles. It is always doable by client wrapping, unless it is something that can benefit more on processing side.

Maybe share more what you have in mind or checkout latest code.
Yes I will accept PRs, just for now lot of experimenting is done (not latest code pushed), so I recommend (as on Readme) first to discuss to avoid big chunks of code hanging around.

[yallxe]

I will describe the issue on an example. A simple problem that comes to my mind is fetching user from some database to verify if he is authorised to perform current request and additionally having access to some of user data within the whole dialog flow. Now, when you've implemented the digest auth server support, it is possible to first authorise the user and if he is granted access to process with the call we can fetch additional data needed within the dialog. But it makes at least two requests to database. It could fetch all user data once.

I'm not sure how middlewares would look in golang as I don't have a lot of experience in it. The only thing that I don't like about them is that they can explicitly modify the state, which can sometimes be confusing. If I hit some idea regarding this I will comment here later.

[yallxe]

P.S. Auth is not really extensible now. Sometimes it is not just digest auth, but for example an IP check, if TCP is used. Or maybe even some custom logic.

[emiago]

@yallxe All those checks are possible, I have already project doing all this. registrar (location service), ip auth, transport auth, digest auth all you can add on top.
I could make this complex auths part of lib (and I will at some point) but I also take my time valuable.
I mean all this authorizations in the end is hard to cover when it comes customizing, as mostly it needs external source,
but I see complex parts like registry, ip auth that could be part of lib. You can DM if you have project and need extra dev on this.