Logon handler

Things get more complicated with regards to the POST handler. As a gentle introduction, we'll add logic to verify passed credentials - by querying the database (Db module):

Db.fs

  77: 
  78: 
  79: 
  80: 
  81: 
  82: 

let validateUser (username, password) (ctx : DbContext) : User option =
    query {
        for user in ctx.Public.Users do
            where (user.Username = username && user.Password = password)
            select user
    } |> Seq.tryHead

The snippet makes use of User type alias:

Db.fs

  23: 

type User = DbContext.``public.usersEntity``

Now, in the App module add more open statements:

App.fs

   1: 
   2: 
   3: 
   4: 
   5: 
   6: 
   7: 
   8: 
   9: 
  10: 
  11: 
  12: 
  13: 
  14: 
  15: 
  16: 
  17: 

module SuaveMusicStore.App

open System

open Suave
open Suave.Authentication
open Suave.Filters
open Suave.Form
open Suave.Model.Binding
open Suave.Operators
open Suave.RequestErrors
open Suave.State.CookieStateStore
open Suave.Successful
open Suave.Web

let html container =
    OK (View.index container)

and add a couple of helper functions:

App.fs

 112: 
 113: 
 114: 
 115: 
 116: 
 117: 

let passHash (pass: string) =
    use sha = Security.Cryptography.SHA256.Create()
    Text.Encoding.UTF8.GetBytes(pass)
    |> sha.ComputeHash
    |> Array.map (fun b -> b.ToString("x2"))
    |> String.concat ""

App.fs

 119: 

let session = statefulForSession

App.fs

 121: 
 122: 
 123: 
 124: 

let sessionStore setF = context (fun x ->
    match HttpContext.state x with
    | Some state -> setF state
    | None -> never)

App.fs

 126: 
 127: 
 128: 
 129: 
 130: 
 131: 
 132: 

let returnPathOrHome = 
    request (fun x -> 
        let path = 
            match (x.queryParam "returnPath") with
            | Choice1Of2 path -> path
            | _ -> Path.home
        Redirection.FOUND path)

Comments:

• passHash - from a given string it creates a SHA256 hash and formats it to hexadecimal. That's how users' passwords are stored in our database.
• session for now is just an alias to statefulForSession from Suave, which initializes a user state for a browsing session. We will however add extra argument to the session function in a few minutes, that's why we might want to have it extracted already.
• sessionStore is a higher-order function, taking setF as a parameter - which in turn can be used to read from or write to the session store.
• returnPathOrHome tries to extract "returnPath" query parameter from the url, and redirects to that path if it exists. If no "returnPath" is found, we get back redirected to the home page.

Now turn for the logon POST handler monster:

App.fs

 134: 
 135: 
 136: 
 137: 
 138: 
 139: 
 140: 
 141: 
 142: 
 143: 
 144: 
 145: 
 146: 
 147: 
 148: 
 149: 
 150: 
 151: 

let logon =
    choose [
        GET >=> (View.logon |> html)
        POST >=> bindToForm Form.logon (fun form ->
            let ctx = Db.getContext()
            let (Password password) = form.Password
            match Db.validateUser(form.Username, passHash password) ctx with
            | Some user ->
                    authenticated Cookie.CookieLife.Session false 
                    >=> session
                    >=> sessionStore (fun store ->
                        store.set "username" user.Username
                        >=> store.set "role" user.Role)
                    >=> returnPathOrHome
            | _ ->
                never
        )
    ]

Not that bad, isn't it? What we do first here is we bind to Form.logon. This means that in case the request is malformed, bindToForm takes care of returning 400 Bad Request status code. If someone however decides to be polite and fill in the logon form correctly, then we reach the database and ask whether such user with such password exists. Note, that we have to pattern match the password string in form result (let (Password password) = form.Password). If Db.validateUser returns Some user then we compose 4 WebParts together in order to correctly set up the user state and redirect user to his destination. First, authenticated sets proper cookies which live till the session ends. The second (false) argument specifies the cookie isn't "HttpsOnly". Then we bind the result to session, which as described earlier, sets up the user session state. Next, we write two values to the session store: "username" and "role". Finally, we bind to returnPathOrHome - we'll shortly see how this one can be useful.

Show code from this section on GitHub