michaelherold / bridgetown-deploy_hook Goto Github PK

Some systems, like Netlify's deploy notifications use alternative means of authentication like signed payloads. This means that authorization should have access to more than just the Authorization header.

I propose sending either:

1. The whole request to the authorizer
2. The (nilable) authorization header and the request
3. Both of the above

The frustrating part of (3) is that we would either need to have complex dispatching logic or cumbersome ignored parameters for stabby lambdas. We could wrap the whole thing in an "authorization request" like:

AuthorizationRequest = Struct.new(:params, :request, :scheme, keyword_init: true)

but this makes one-liners a bit hard to read by changing:

{
  authorization: {
    bearer: ->(token) { token == ENV["MY_TOKEN"] }
  }
}

into:

{
  authorization: ->(auth) { auth.scheme == "Bearer" && auth.params == ENV["MY_TOKEN"] }
}

but I think that's probably okay. More complexity is probably not necessary or wanted; having an authorizer be a few lines isn't a bad thing and might push people to use objects instead of lambdas.

Note that this will be a breaking change which is okay since we're still in pre-1.0.