Skip to content

Commit

Permalink
refactor: new structure (#86)
Browse files Browse the repository at this point in the history
* docs: first draft of new structure

* chore: move back to sentence casing

* chore: remove .DS_Store file

* chore: update casing of HTTP

* chore: update GH discussions link

* chore: remove bunch of redirects

* chore: correct bunch of link, tables, images and code examples

* chore: write lucid & edge page

* chore: write deployment guide

* fix(deployment): correct heading

* chore(deployment): add Dockerfile

* chore(deployment): remove not needed cache view directive

* chore(deployment): remove ignore ts errors flag in dockerfile

* chore: rename rc file to adonisrc file

* chore: rename securing ssr apps

* chore: rename api references to references

* chore: correct redirect for rc file

* chore: improve the content of quick lucid doc

* fix: correct broken links
  • Loading branch information
RomainLanz authored May 7, 2024
1 parent 2f7243c commit 61c3e0c
Show file tree
Hide file tree
Showing 137 changed files with 3,131 additions and 2,527 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@ A typical database entry has the following properties.
{
"permalink": "introduction",
"title": "Introduction",
"contentPath": "./introduction.md",
"contentPath": "./http_overview.md",
"category": "Guides"
}
```
Expand Down
4 changes: 2 additions & 2 deletions content/docs/ace/creating_commands.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

Alongside using Ace commands, you may also create custom commands as part of your application codebase. The commands are stored inside the `commands` directory (at the root level). You may create a command by running the following command.

See also: [Make command](../reference/commands.md#makecommand)
See also: [Make command](../references/commands.md#makecommand)

```sh
node ace make:command greet
Expand Down Expand Up @@ -229,7 +229,7 @@ export default class GreetCommand extends BaseCommand {

## Dependency injection

Ace commands are constructed and executed using the [IoC container](../fundamentals/ioc_container.md). Therefore, you can type-hint dependencies on command lifecycle methods and use the `@inject` decorator to resolve them.
Ace commands are constructed and executed using the [IoC container](../../concepts/dependency_injection). Therefore, you can type-hint dependencies on command lifecycle methods and use the `@inject` decorator to resolve them.

For demonstration, let's inject the `UserService` class in all the lifecycle methods.

Expand Down
2 changes: 1 addition & 1 deletion content/docs/ace/prompts.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ Prompts are interactive terminal widgets you can use to accept user input. Ace p

Ace prompts are built with testing in mind. When writing tests, you may trap prompts and respond to them programmatically.

See also: [Testing ace commands](../testing/commandline_tests.md)
See also: [Testing ace commands](../../testing/console_tests)

## Displaying a prompt

Expand Down
2 changes: 1 addition & 1 deletion content/docs/ace/tui.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ Ace terminal UI is powered by the [@poppinss/cliui](https://github.com/poppinss/

The terminal UI primitives are built with testing in mind. When writing tests, you may turn on the `raw` mode to disable colors and formatting and collect all logs in memory to write assertions against them.

See also: [Testing Ace commands](../testing/commandline_tests.md)
See also: [Testing Ace commands](../../testing/console_tests)

## Displaying log messages

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ In the following example, we **find a user by id** and **issue them an access to

The `.create` method accepts an instance of the User model and returns an instance of the [AccessToken](https://github.com/adonisjs/auth/blob/main/modules/access_tokens_guard/access_token.ts) class.

The `token.value` property contains the value (wrapped as a [Secret](../reference/helpers.md#secret)) that must be shared with the user. The value is only available when generating the token, and the user will not be able to see it again.
The `token.value` property contains the value (wrapped as a [Secret](../references/helpers.md#secret)) that must be shared with the user. The value is only available when generating the token, and the user will not be able to see it again.

```ts
import router from '@adonisjs/core/services/router'
Expand Down Expand Up @@ -235,7 +235,7 @@ await User.accessTokens.create(user, ['server:create', 'server:read'])

### Token abilities vs. Bouncer abilities

You should not confuse token abilities with [bouncer authorization checks](../digging_deeper/authorization.md#defining-abilities). Let's try to understand the difference with a practical example.
You should not confuse token abilities with [bouncer authorization checks](../security/authorization.md#defining-abilities). Let's try to understand the difference with a practical example.

- Let's say you define a **bouncer ability that allows admin users to create new projects**.

Expand Down Expand Up @@ -341,7 +341,7 @@ The `tokensUserProvider` method accepts the following options and returns an ins
## Authenticating requests
Once the guard has been configured, you can start authenticating requests using the `auth` middleware or manually calling the `auth.authenticate` method.

The `auth.authenticate` method returns an instance of the User model for the authenticated user, or it throws an [E_UNAUTHORIZED_ACCESS](../reference/exceptions.md#e_unauthorized_access) exception when unable to authenticate the request.
The `auth.authenticate` method returns an instance of the User model for the authenticated user, or it throws an [E_UNAUTHORIZED_ACCESS](../references/exceptions.md#e_unauthorized_access) exception when unable to authenticate the request.

```ts
import router from '@adonisjs/core/services/router'
Expand Down Expand Up @@ -393,7 +393,7 @@ class PostsController {

### Get authenticated user or fail

If you do not like using the [non-null assertion operator](https://www.typescriptlang.org/docs/handbook/2/everyday-types.html#non-null-assertion-operator-postfix-) on the `auth.user` property, you may use the `auth.getUserOrFail` method. This method will return the user object or throw [E_UNAUTHORIZED_ACCESS](../reference/exceptions.md#e_unauthorized_access) exception.
If you do not like using the [non-null assertion operator](https://www.typescriptlang.org/docs/handbook/2/everyday-types.html#non-null-assertion-operator-postfix-) on the `auth.user` property, you may use the `auth.getUserOrFail` method. This method will return the user object or throw [E_UNAUTHORIZED_ACCESS](../references/exceptions.md#e_unauthorized_access) exception.

```ts
import { HttpContext } from '@adonisjs/core/http'
Expand Down Expand Up @@ -483,4 +483,4 @@ await User.accessTokens.delete(user, token.identifier)
```

## Events
Please check the [events reference guide](../reference/events.md#access_tokens_authauthentication_attempted) to view the list of available events emitted by the access tokens guard.
Please check the [events reference guide](../references/events.md#access_tokens_authauthentication_attempted) to view the list of available events emitted by the access tokens guard.
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Basic authentication
# Basic authentication guard

The basic auth guard is an implementation of the [HTTP authentication framework](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication), in which the client must pass the user credentials as a base64 encoded string via the `Authorization` header. The server allows the request if the credentials are valid. Otherwise, a web-native prompt is displayed to re-enter the credentials.

Expand Down Expand Up @@ -33,7 +33,7 @@ The `basicAuthUserProvider` method creates an instance of the [BasicAuthLucidUse


## Preparing the User model
The model (`User` model in this example) configured with the `basicAuthUserProvider` must use the [AuthFinder](./verifying_user_credentials.md#using-the-auth-finder-mixin) mixin to verify the user credentials during authentication.
The model (`User` model in this example) configured with the `basicAuthUserProvider` must use the [AuthFinder](verifying_user_credentials.md#using-the-auth-finder-mixin) mixin to verify the user credentials during authentication.

```ts
import { DateTime } from 'luxon'
Expand Down Expand Up @@ -123,7 +123,7 @@ router
```

### Get authenticated user or fail
If you do not like using the [non-null assertion operator](https://www.typescriptlang.org/docs/handbook/2/everyday-types.html#non-null-assertion-operator-postfix-) on the `auth.user` property, you may use the `auth.getUserOrFail` method. This method will return the user object or throw [E_UNAUTHORIZED_ACCESS](../reference/exceptions.md#e_unauthorized_access) exception.
If you do not like using the [non-null assertion operator](https://www.typescriptlang.org/docs/handbook/2/everyday-types.html#non-null-assertion-operator-postfix-) on the `auth.user` property, you may use the `auth.getUserOrFail` method. This method will return the user object or throw [E_UNAUTHORIZED_ACCESS](../references/exceptions.md#e_unauthorized_access) exception.

```ts
import { middleware } from '#start/kernel'
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,7 @@ Authenticating a request includes:
- Verifying its authenticity.
- Fetching the user for whom the token was generated.

Our guard will need access to the [HttpContext](../http/http_context.md) to read request headers and cookies, so let's update the class `constructor` and accept it as an argument.
Our guard will need access to the [HttpContext](../concepts/http_context.md) to read request headers and cookies, so let's update the class `constructor` and accept it as an argument.

```ts
// insert-start
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ The auth package narrowly focuses on authenticating HTTP requests, and the follo

- User registration features like **registration forms**, **email verification**, and **account activation**.
- Account management features like **password recovery** or **email update**.
- Assigning roles or verifying permissions. Instead, [use bouncer](../digging_deeper/authorization.md) to implement authorization checks in your application.
- Assigning roles or verifying permissions. Instead, [use bouncer](../security/authorization.md) to implement authorization checks in your application.


<!-- :::note
Expand All @@ -38,11 +38,11 @@ It provides ready-to-use actions for user registration, email management, sessio

## Choosing an auth guard

The following inbuilt authentication guards provide you with the most straightforward workflow for authenticating users without compromising the security of your applications. Also, you can [build your authentication guards](./custom_auth_guards.md) for custom requirements.
The following inbuilt authentication guards provide you with the most straightforward workflow for authenticating users without compromising the security of your applications. Also, you can [build your authentication guards](custom_auth_guard) for custom requirements.

### Session

The session guard uses the [@adonisjs/session](../http/session.md) package to track the logged-in user state inside the session store.
The session guard uses the [@adonisjs/session](../basics/session.md) package to track the logged-in user state inside the session store.

Sessions and cookies have been on the internet for a long time and work great for most applications. We recommend using the session guard:

Expand Down Expand Up @@ -127,7 +127,7 @@ node ace add @adonisjs/auth --guard=basic_auth
## The Initialize auth middleware
During setup, we register the `@adonisjs/auth/initialize_auth_middleware` within your application. The middleware is responsible for creating an instance of the [Authenticator](https://github.com/adonisjs/auth/blob/main/src/authenticator.ts) class and shares it via the `ctx.auth` property with the rest of the request.

Note that the initialize auth middleware does not authenticate the request or protect the routes. It's used only for initializing the authenticator and sharing it with the rest of the request. You must use the [auth](./session_guard.md#protecting-routes) middleware for protecting routes.
Note that the initialize auth middleware does not authenticate the request or protect the routes. It's used only for initializing the authenticator and sharing it with the rest of the request. You must use the [auth](session_guard.md#protecting-routes) middleware for protecting routes.

Also, the same authenticator instance is shared with Edge templates (if your app is using Edge), and you can access it using the `auth` property. For example:

Expand Down Expand Up @@ -170,6 +170,6 @@ Also, update the `User` model if you define, rename, or remove columns from the

## Next steps

- Learn how to [verify user credentials](./verifying_user_credentials.md) without compromising the security of your application.
- Use [session guard](./session_guard.md) for stateful authentication.
- Use [access tokens guard](./access_tokens_guard.md) for tokens based authentication.
- Learn how to [verify user credentials](verifying_user_credentials.md) without compromising the security of your application.
- Use [session guard](session_guard.md) for stateful authentication.
- Use [access tokens guard](access_tokens_guard.md) for tokens based authentication.
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Session guard
The session guard uses the [@adonisjs/session](../http/session.md) package to login and authenticate users during an HTTP request.
The session guard uses the [@adonisjs/session](../basics/session.md) package to login and authenticate users during an HTTP request.

Sessions and cookies have been on the internet for a long time and work great for most applications. Therefore, we recommend using the session guard for server-rendered applications or an SPA web client on the same top-level domain.

Expand Down Expand Up @@ -39,7 +39,7 @@ You can login a user using the `guard.login` method. The method accepts an insta

In the following example:

- We use the `verifyCredentials` from the [AuthFinder mixin](./verifying_user_credentials.md#using-the-auth-finder-mixin) to find a user by email and password.
- We use the `verifyCredentials` from the [AuthFinder mixin](verifying_user_credentials.md#using-the-auth-finder-mixin) to find a user by email and password.

- The `auth.use('web')` returns an instance of the [SessionGuard](https://github.com/adonisjs/auth/blob/main/modules/session_guard/guard.ts) configured inside the `config/auth.ts` file.

Expand Down Expand Up @@ -193,7 +193,7 @@ router

### Get authenticated user or fail

If you do not like using the [non-null assertion operator](https://www.typescriptlang.org/docs/handbook/2/everyday-types.html#non-null-assertion-operator-postfix-) on the `auth.user` property, you may use the `auth.getUserOrFail` method. This method will return the user object or throw [E_UNAUTHORIZED_ACCESS](../reference/exceptions.md#e_unauthorized_access) exception.
If you do not like using the [non-null assertion operator](https://www.typescriptlang.org/docs/handbook/2/everyday-types.html#non-null-assertion-operator-postfix-) on the `auth.user` property, you may use the `auth.getUserOrFail` method. This method will return the user object or throw [E_UNAUTHORIZED_ACCESS](../references/exceptions.md#e_unauthorized_access) exception.

```ts
import { middleware } from '#start/kernel'
Expand All @@ -210,7 +210,7 @@ router
```

### Access user within Edge templates
The [InitializeAuthMiddleware](./introduction.md#the-initialize-auth-middleware) also shares the `ctx.auth` property with Edge templates. Therefore, you can access the currently logged-in user via the `auth.user` property.
The [InitializeAuthMiddleware](introduction.md#the-initialize-auth-middleware) also shares the `ctx.auth` property with Edge templates. Therefore, you can access the currently logged-in user via the `auth.user` property.

```edge
@if(auth.isAuthenticated)
Expand Down Expand Up @@ -394,4 +394,4 @@ router
Finally, you can configure the redirect route for the logged-in users inside the `./app/middleware/guest_middleware.ts` file.

## Events
Please check the [events reference guide](../reference/events.md#session_authcredentials_verified) to view the list of available events emitted by the Auth package.
Please check the [events reference guide](../references/events.md#session_authcredentials_verified) to view the list of available events emitted by the Auth package.
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ Ally comes with the following inbuilt drivers, alongside an extensible API to [r
- Discord
- LinkedIn

Ally does not store any users or access tokens on your behalf. It implements the OAuth2 and OAuth1 protocols, authenticates a user with social service, and provides user details. You can store that information inside a database and use the [auth](../auth/introduction.md) package to login the user within your application.
Ally does not store any users or access tokens on your behalf. It implements the OAuth2 and OAuth1 protocols, authenticates a user with social service, and provides user details. You can store that information inside a database and use the [auth](introduction.md) package to login the user within your application.

## Installation

Expand Down Expand Up @@ -235,7 +235,7 @@ The scopes can be defined within the `config/ally.ts` file, or you can define th
Thanks to TypeScript, you will get autocomplete suggestions for all the available scopes.
![](./ally_autocomplete.png)
![](../digging_deeper/ally_autocomplete.png)
```ts
// title: config/ally.ts
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ By default, we provide secure APIs to find users and verify their passwords. How
In this guide, we will cover the process of finding a user by a UID and verifying their password before marking them as logged in.

## Basic example
You can use the User model directly to find a user and verify their password. In the following example, we find a user by email and use the [hash](../security/hash.md) service to verify the password hash.
You can use the User model directly to find a user and verify their password. In the following example, we find a user by email and use the [hash](../security/hashing) service to verify the password hash.

```ts
import { HttpContext } from '@adonisjs/core/http'
Expand Down Expand Up @@ -117,7 +117,7 @@ export default class User extends compose(BaseModel, AuthFinder) {
- `uids`: An array of model properties that can be used to identify a user uniquely. If you assign a user a username or phone number, you can also use them as a UID.
- `passwordColumnName`: The model property name that holds the user password.

- Finally, you can use the return value of the `withAuthFinder` method as a [mixin](../reference/helpers.md#compose) on the User model.
- Finally, you can use the return value of the `withAuthFinder` method as a [mixin](../references/helpers.md#compose) on the User model.

### Verifying credentials
Once you have applied the Auth finder mixin, you can replace all the code from the `SessionController.store` method with the following code snippet.
Expand Down Expand Up @@ -160,19 +160,19 @@ export default class SessionController {
```

### Handling exceptions
In case of invalid credentials, the `verifyCredentials` method will throw [E_INVALID_CREDENTIALS](../reference/exceptions.md#e_invalid_credentials) exception.
In case of invalid credentials, the `verifyCredentials` method will throw [E_INVALID_CREDENTIALS](../references/exceptions.md#e_invalid_credentials) exception.

The exception is self-handled and will be converted to a response using the following content negotiation rules.

- HTTP requests with the `Accept=application/json` header will receive an array of error messages. Each array element will be an object with the message property.

- HTTP requests with the `Accept=application/vnd.api+json` header will receive an array of error messages formatted per the JSON API spec.

- If you use sessions, the user will be redirected to the form and receive the errors via [session flash messages](../http/session.md#flash-messages).
- If you use sessions, the user will be redirected to the form and receive the errors via [session flash messages](../basics/session.md#flash-messages).

- All other requests will receive errors back as plain text.

However, if needed, you can handle the exception inside the [global exception handler](../http/exception_handling.md) as follows.
However, if needed, you can handle the exception inside the [global exception handler](../basics/exception_handling.md) as follows.

```ts
// highlight-start
Expand Down
Loading

0 comments on commit 61c3e0c

Please sign in to comment.