But, if I dont misunderstand myself, I have not duplicated code in the actual code: the IP check and the authentication only happens in get_first while in <c>get_second only a cookie is checked, no?

Well yes, but since http is stateless, what happens if get_second gets called first?

I'm developing some Mojolicious::Lite apps at the time, and my layout is as follows

#!/usr/bin/perl

use Mojolicious::Lite;
use Foo::Blargh; # yadda yadda, other usefull stuff

get "/login" => sub {
    my $c = shift; # $c is the controller object
    $c->render('login'); # renders templates/login.html.ep
};

# this sub checks username and password
post "/login" => sub {
    validate_user(shift); # the sub gets the controller
};

get "/logout" => sub {
    my $c = shift;
    $c->cookie(MySession => 'none'); # unset cookie
    $c->redirect_to("/login");
};

# with the following, all following routes require 
# a logged-in user and a proper cookie

under sub {
    validate_cookie(shift);
};

# more routes
get "/foo" => sub {
    my $c = shift;
    ...
    $c->render($whatever);
};
get "/bar" => sub {
    my $c = shift;
    ...
    $c->render($something_else);
};

# all set up, start the application;
app->start;

###
##
# subs

sub validate_cookie {
    my $c = shift;
    my $cookie = $c->cookie('MySession');
    if (! $cookie) {
        $c->redirect_to('/login');
        return; # important!
    } else {
        # more checks to see if cookie is valid
        ...
    }
    1;
}

sub validate_user {
    my $c = shift;
    my $u = $c->param('user');
    my $p = $c->param('pass');
    if ( login($u,$p) ) {
        # set cookie. Multiple cookies can be set by calling
        # $c->cookie() with other key/value pairs more than 1 time
        $c->cookie(MySession => generate_cookie() );
        $c->redirect_to('/foo'); # whatever is appropriate
        return;
    }
    $c->stash(error => 'wrong user or password'); # gets rendered in /
+login
    $c->render('login');
    return;
}

sub login {
    # validate user and password: database, ldap, ...
    # returns 1 on success, nothing on failure
}

sub generate_cookie {
    my $n = shift || 42;
    my @chars = ('A'..'Z','a'..'z',0..9,'+','/' ); # we use the BASE64
+ chars
    join '', map{ $chars[rand @chars] }1..$n; # session ID
}
[download]

Works for me ;-)

thanks shmem really appreciated,

> what happens if get_second gets called first?

I suppose my application will reject the request because the cookie was not set; is my mojo DWIM? But this is not importatnt at the moment.

I still miss the meaning of this sugar called under and I read about it. I cant capacitate how your example can be similar to others in this thread where syntax like my $foo = $r->under('/foo')->to('foo#baz'); are presented like in the docs.

How other examples in this thread can use under in a total different way?

With your comment with the following, all following routes require a logged-in user and a proper cookie you mean that if some route is positioned in the file after an under one, this is executed? Like as it was a pragma no strict usage?

Sincerily I found this option highly unreadable: or, as you have done, you put a BIG comment stating it clear, or after 100 lines everyone forget the under is in use. I see you can group routes using under and sounds saner... but I miss the sense of the code presented in the example.. ( the route is /admin/dashboard or /dashboard ??)

Anyway thanks a lot to you and to all others contributors of this thread

L*

There are no rules, there are no thumbs..
Reinvent the wheel, then learn The Wheel; may be one day you reinvent one of THE WHEELS.

Once the under() sub is compiled, all following get() and post() etc calls get compiled as calling this under() sub first.

So

under sub { validate_cookie() };
get "/foo" => sub {
    my $c = shift;
    ...
};
get "/bar" => sub {
    my $c = shift;
    ...
};
[download]

is equivalent to

get "/foo" => sub {
    validate_cookie() or return;
    my $c = shift;
    ...
};
get "/bar" => sub {
    validate_cookie() or return;
    my $c = shift;
    ...
};
[download]

perl -le'print map{pack c,($-++?1:13)+ord}split//,ESEL'

I cant capacitate how your example can be similar to others in this thread where syntax like my $foo = $r->under('/foo')->to('foo#baz'); are presented like in the docs.

That code looks more like it comes from a regular Mojolicious application rather than a Mojolicious::Lite application - see Mojolicious::Guides::Growing for the link between the two. Basically, Mojolicious::Lite just adds some sugar to make accessing the API easier. For example, in a regular Mojo app, one might write my $foo = $app->routes->under('/foo')->to('foo#baz'); (which would call the sub baz in AppClass::Controller::Foo as the handler), while ::Lite just has the under helper to make that easier: it just calls the sub that you pass to it, and it is automatically applied to any following routes (or routes in the same group), whereas in the previous example one has to use $foo to define routes that are affected by the under.

Hi Discipulus,

I have really looked forward to assisting you in some trivial matter because of the MAJOR enlightenment and joy you add to Perlmonks!!

You really need to look at under because it is exactly what you want, I'm pretty sure!

I'll try to provide some code specific to your example, but this is from a small web site (like 200 occasional users)

my $onlyLoggedIn = $r->under('/admin' => \&loggedIn);
$onlyLoggedIn->post('uploadFile')->to('files#insert');
$onlyLoggedIn->delete('files')->to('files#delete');

sub loggedIn {
    my $c = shift;
    if ($c->session('login')) {
        return 1;
    }
    $c->render(
        template => 'login',
        title => 'website title',
        status => 401,
    );
    return 0;
};

# elsewhere

sub login {
    my $self = shift;
    my $name = $self->param('user');
    my $password = $self->param('password');
    my $responseCode = 401;

        # Pretty sure this hashes the param and checks it against the 
+hashed database entry
    if (Something::Model::Users::login($name,$password)) {
        # $self->signed_cookie(loggedIn => 1);
        $self->session(expiration => 60*60*10);
        $self->session(login => $name);
        $responseCode = 200;
        $self->app->log->warn("$name logged in.");
    } else {
        $self->app->log->warn("Invalid login - '$name'");
    }
    $self->render(data => '',status => $responseCode);
}
[download]

So we have all urls /admin/whatever for only authenticated users.

Something I recently learned

    $self->helper( onlyauth => sub {
        my ($c,$block) = @_;
        if ($c->session('login')) {
            return $block->() if $block;
        }
    });
[download]

So I can use this in my templates!! I have an admin bar at the top of every regular page that only logged in users see

%= onlyauth begin
    %= include 'adminbar'
% end
[download]

Manual shows layout ... A daddy template