biff.datalevin.middleware — io.github.datalevin/biff-datalevin 0.3.19

Ring middleware for authentication, CSRF protection, and context injection.

Provides Biff-style middleware composition for web applications.

csrf-input clj

(csrf-input)

Returns a hidden input field hiccup for CSRF token.

Example: [:form {:method "post"} (csrf-input) [:button "Submit"]]

csrf-token clj

(csrf-token)

Returns the current CSRF token for use in forms.

Must be called within a request handled by wrap-csrf.

wrap-api-defaults clj

(wrap-api-defaults
  handler
  {:keys [context session-secret auth?] :or {auth? true} :as opts})

Middleware stack for API routes (no sessions or CSRF).

Includes everything from wrap-base-defaults plus:

• JWT authentication (via Authorization header)

Options: :context - System context to inject :session-secret - Secret for JWT verification :auth? - Enable authentication middleware (default true)

wrap-authentication clj

(wrap-authentication handler
                     {:keys [session-secret cookie-name header-name]
                      :or {cookie-name "session" header-name "authorization"}})

Authenticates requests using session cookies or JWT tokens.

Checks for:

1. Ring session with :user key (from wrap-session)
2. Authorization header with Bearer token (JWT)
3. Session cookie with JWT token

Adds :user to the request if authenticated.

Options: :session-secret - Secret for JWT verification (required for token auth) :cookie-name - Name of session cookie (default "session") :header-name - Name of auth header (default "authorization")

wrap-base-defaults clj

(wrap-base-defaults handler {:keys [context] :as opts})

Base middleware stack for all routes.

Includes:

• Parameter parsing (query string and form)
• Keyword parameter keys
• Cookie handling
• Context injection

Options: :context - System context to inject into requests

wrap-catch-exceptions clj

(wrap-catch-exceptions handler)

(wrap-catch-exceptions handler {:keys [on-error response]})

Catches exceptions and returns a 500 response.

Options: :on-error - Function called with request and exception :response - Custom error response map

wrap-context clj

(wrap-context handler context)

Injects the system context into each request.

The context map is merged into the request, providing handlers access to system components like the database connection.

Example: (wrap-context handler {:biff.datalevin/conn conn})

wrap-csrf clj

(wrap-csrf handler)

(wrap-csrf handler opts)

CSRF protection middleware.

Wraps ring-anti-forgery with sensible defaults.

Options: :error-response - Custom error response for CSRF failures :read-token - Function to extract token from request :token-name - Form field name for token (default "__anti-forgery-token")

wrap-logging clj

(wrap-logging handler)

(wrap-logging handler {:keys [log-fn] :or {log-fn println}})

Logs request method, URI, and response status.

Options: :log-fn - Custom logging function (default println)

wrap-require-auth clj

(wrap-require-auth handler)

(wrap-require-auth handler
                   {:keys [redirect message] :or {message "Unauthorized"}})

Middleware that requires authentication.

Returns 401 Unauthorized if :user is not present in the request.

Options: :redirect - URL to redirect to instead of 401 (for web apps) :message - Custom error message

wrap-require-role clj

(wrap-require-role handler
                   {:keys [role roles redirect message]
                    :or {message "Forbidden"}})

Middleware that requires a specific user role.

Returns 403 Forbidden if user doesn't have the required role.

Options: :role - Required role keyword (e.g., :admin) :roles - Set of acceptable roles :redirect - URL to redirect to instead of 403 :message - Custom error message

wrap-site-defaults clj

(wrap-site-defaults handler
                    {:keys [context session-secret session-store csrf? auth?]
                     :or {csrf? true auth? true}
                     :as opts})

Middleware stack for website routes (with sessions and CSRF).

Includes everything from wrap-base-defaults plus:

• Session handling (cookie or Datalevin store)
• CSRF protection
• Authentication

Options: :context - System context to inject :session-secret - Secret for session cookies :session-store - Ring session store (defaults to cookie store) :csrf? - Enable CSRF protection (default true) :auth? - Enable authentication middleware (default true)