dvAdminAuthorized function

Future<bool> dvAdminAuthorized(Request request)

Whether request comes from somebody allowed to open Studio.

Two questions, and a session answers only the first. The request has to carry a live session of the application's own -- the same stage the generated backend authenticates every route with, on the tenant the request names; a revoked, expired or forged one is nobody, and so is an API key, because the dashboard is opened by a person. Then DV.Auth.authorization has to allow that person dvStudioAccessAction, which it does for nobody unless a grant or the application's own policy says so. Signing up to the application is not signing up to its admin.

Implementation

Future<bool> dvAdminAuthorized(Request request) => dvWithRequestTenant(
  request,
  () async {
    final DVSessionAuthenticationResult result =
        await DVSessionAuthentication.authenticateRequest(
          plainLocal: DVSessionCookie.plainLocal(
            request.url,
            forwardedProto: request.headers.get('x-forwarded-proto'),
            host: request.headers.get('host'),
          ),
          authorization: request.headers.get('authorization'),
          cookie: request.headers.get('cookie'),
        );
    final DVSessionPrincipal? principal = result.principal;
    if (result.refused || principal == null) return false;
    const DVAuthAuthorization authorization = DVAuthAuthorization();
    // The application's user where its policy is written against that
    // type, the principal otherwise: the choice every route makes.
    final Object? user = principal.user;
    final Object caller =
        user != null && authorization.acceptsCaller(dvStudioAccessAction, user)
        ? user
        : principal;
    return DVSessionPrincipal.actingAs(
      principal,
      () => authorization.canAction(caller, dvStudioAccessAction),
    );
  },
);