@@ -14,7 +14,7 @@ import Data.Text (Text)
1414import GHC.Generics (Generic)
1515import Network.HTTP.Client (Manager, Request, Response, httpLbs,
1616 responseBody, responseStatus, responseHeaders)
17−import Network.HTTP.Types (status500, status405, parseMethod)
17+import Network.HTTP.Types (status500, status405, status401, parseMethod)
1818
1919-- | @500 Internal Server Error@ should be avoided - it may represent some
2020-- issue with the application code, and it moreover gives the client little
@@ -65,6 +65,7 @@ getsHaveLastModifiedHeader
6565 = ResponsePredicate "getsHaveLastModifiedHeader" (\resp ->
6666
6767-}
68+
6869-- | When an HTTP request has a method that is not allowed, a 405 response
6970-- should be returned. Additionally, it is good practice to return an @Allow@
7071-- header with the list of allowed methods.
@@ -154,23 +155,29 @@ optionsContainsValidAllow
154155-- This function checks that any @Link@ headers have values in the correct
155156-- format.
156157--
157−-- References: RFC 5988 Section 5
158−-- https://tools.ietf.org/html/rfc5988
158+-- __References__:
159+--
160+-- * <https://tools.ietf.org/html/rfc5988 RFC 5988 Section 5>
159161linkHeadersAreValid :: Predicate b Bool
160162linkHeadersAreValid
161163 = ResponsePredicate "linkHeadersAreValid" _
162164
165+-}
163166-- | Any @401 Unauthorized@ response must include a @WWW-Authenticate@ header.
164167--
165168-- This function checks that, if a response has status code 401, it contains a
166169-- @WWW-Authenticate@ header.
167170--
168−-- References: RFC 7235 Section 4.1
169−-- https://tools.ietf.org/html/rfc7235#section-4.1
170−unauthorizedContainsWWWAuthenticate :: Predicate b Bool
171+-- __References__:
172+--
173+-- * @WWW-Authenticate@ header: <https://tools.ietf.org/html/rfc7235#section-4.1 RFC 7235 Section 4.1>
174+unauthorizedContainsWWWAuthenticate :: ResponsePredicate Text Bool
171175unauthorizedContainsWWWAuthenticate
172− = ResponsePredicate "unauthorizedContainsWWWAuthenticate" _
173−-}
176+ = ResponsePredicate "unauthorizedContainsWWWAuthenticate" (\resp ->
177+ if responseStatus resp == status401
178+ then hasValidHeader "WWW-Authenticate" (const True) resp
179+ else True)
180+
174181-- * Predicate logic
175182
176183-- The idea with all this footwork is to not waste any requests. Rather than