Optional authentication question

[robertfshort]

Question

I apologize if I'm just blind and missed this or just didn't understand it in the documentation... Lets say I have a route for login but then I have another route that I want to be able to be called publicly, just do different things if the user already logged into the other page. How do I go about getting what user is logged in?

[Badgerati]

Hey @robertfshort,

Sorry for the late response here, I've been ill this past week :(

If I'm reading you correctly: you want a route, that is publicly available, to do one thing; but if a user happens to be logged in (ie, has a session) then do a slightly different thing?

That sounds about right, or am I way off? 😂 If it's this, then I don't actually think there's a way of having an "optional" authorised route currently; something I can look into though!

[robertfshort]

Yes that is correct. So some more context: The plan is to have user roles which define the user's access, such as, admin, edit, view (all or subset) and then publicly available without the need to authentication. My auth scheme is going to be Azure AD. So user A is anon, they hit the route/view knows they are not logged in and returns the public data from a SQL call. User B has limited access, so when they hit the view they get the limited results and User C is admin and gets everything.

So basically I'd need to pass the SQL query the user's role, or just 'public' if the user is not logged in.

[Badgerati]

I'll have a look to see if there's a possible way of doing this currently, but off the top of my head I don't think there is. If not, I'll see if it can be added in :)

[robertfshort]

thanks, I appreciate it!

[robertfshort]

I'm pretty sure I can make this work with the middleware sessions. If I'm not logged in, that middleware session is null. But this would be an area where the tutorials could use a bit more in depth description.

[robertfshort]

Side question to this though... How do I clear a session on logout...?

[Badgerati]

Which middleware session value are you referring to? If it's $WebEvent.Session, then there will be cases where this will have a "session" when nobody is logged in; as you can set data against an anonymous session.

One way to do it would be like how Pode.Web handles this with the Home page, where it's viewable by logged in and anonymous users. There, it checks both $WebEvent.Auth as well as the Auth data within the session:

function Get-PodeWebAuthData
{
    $authData = $WebEvent.Auth
    if (($null -eq $authData) -or ($authData.Count -eq 0)) {
        $authData = $WebEvent.Session.Data.Auth
    }

    return $authData
}

If nobody is signed in, that function returns $null. It's not the most elegant way of doing it, and could probably do with a proper function and to document that.

---

Do you have a dedicated route with the -Logout switch? That should remove the session automatically. If not, there's Remove-PodeSession which will remove the current session.