@@ -245,25 +245,28 @@ your feedback!
246### What is Generalized Authentication?
246### What is Generalized Authentication?
248−**TL;DR**: you throw a tagged `AuthProtect` combinator in front of the endpoints
248+**TL;DR**: you throw a tagged `AuthProtect` combinator in front of the
249−you want protected and then supply a function `Request -> Handler user`
249+endpoints you want protected and then supply a function `Request -> Handler a`,
250+where `a` is the type of your choice representing the data returned by
251+successful authentication - e.g., a `User` or, in our example below, `Account`.
250−which we run anytime a request matches a protected endpoint. It precisely solves
252+This function is run anytime a request matches a protected endpoint. It
251−the "I just need to protect these endpoints with a function that does some
253+precisely solves the "I just need to protect these endpoints with a function
252−complicated business logic" and nothing more. Behind the scenes we use a type
254+that does some complicated business logic" and nothing more. Behind the scenes
253−family instance (`AuthServerData`) and `Context` to accomplish this.
255+we use a type family instance (`AuthServerData`) and `Context` to accomplish
255### Generalized Authentication in Action
258### Generalized Authentication in Action
257Let's implement a trivial authentication scheme. We will protect our API by
260Let's implement a trivial authentication scheme. We will protect our API by
258looking for a cookie named `"servant-auth-cookie"`. This cookie's value will
261looking for a cookie named `"servant-auth-cookie"`. This cookie's value will
259−contain a key from which we can lookup a `User`.
262+contain a key from which we can lookup a `Account`.
261```haskell
264```haskell
262−-- | A user type that we "fetch from the database" after
265+-- | An account type that we "fetch from the database" after
263-- performing authentication
266-- performing authentication
264newtype Account = Account { unAccount :: Text }
267newtype Account = Account { unAccount :: Text }
266−-- | A (pure) database mapping keys to users.
269+-- | A (pure) database mapping keys to accounts.
267database :: Map ByteString Account
270database :: Map ByteString Account
268database = fromList [ ("key1", Account "Anne Briggs")
271database = fromList [ ("key1", Account "Anne Briggs")
269 , ("key2", Account "Bruce Cockburn")
272 , ("key2", Account "Bruce Cockburn")
@@ -279,7 +282,7 @@ lookupAccount key = case Map.lookup key database of
281For generalized authentication, servant exposes the `AuthHandler` type,
284For generalized authentication, servant exposes the `AuthHandler` type,
282−which is used to wrap the `Request -> Handler user` logic. Let's
285+which is used to wrap the `Request -> Handler Account` logic. Let's
283create a value of type `AuthHandler Request Account` using the above `lookupAccount`
286create a value of type `AuthHandler Request Account` using the above `lookupAccount`
@@ -377,13 +380,13 @@ forward:
3781. use the `AuthProtect` combinator to protect your API.
3811. use the `AuthProtect` combinator to protect your API.
3792. choose a application-specific data type used by your server when
3822. choose a application-specific data type used by your server when
380−authentication is successful (in our case this was `User`).
383+authentication is successful (in our case this was `Account`).
381−3. Create a value of `AuthHandler Request User` which encapsulates the
384+3. Create a value of `AuthHandler Request Account` which encapsulates the
382−authentication logic (`Request -> Handler User`). This function
385+authentication logic (`Request -> Handler Account`). This function
383will be executed everytime a request matches a protected route.
386will be executed everytime a request matches a protected route.
3844. Provide an instance of the `AuthServerData` type family, specifying your
3874. Provide an instance of the `AuthServerData` type family, specifying your
385application-specific data type returned when authentication is successful (in
388application-specific data type returned when authentication is successful (in
386−our case this was `User`).
389+our case this was `Account`).