works.iterative.server.http

Error handler for authentication and authorization failures.

This object provides HTTP4S response mapping for AuthenticationError enum variants. It ensures consistent error responses across the application:

• Unauthenticated → 401 Unauthorized
• Forbidden → 403 Forbidden
• InvalidCredentials → 401 Unauthorized
• TokenExpired → 401 Unauthorized
• InvalidToken → 401 Unauthorized

Usage in HTTP routes:

 service.updateDocument(id, title)
   .mapError {
     case e: AuthenticationError => AuthErrorHandler.toResponse(e)
   }

Authenticated web module is similar to ZIOWebModule, but it requires additional Context type parameter. This type parameter is used by the authentication system to provide additional information about the authenticated user.

To convert AuthedZIOWebModule to ZIOWebModule, you will need to provide authentication middleware, e.g. by using pac4j:

trait Pac4jZIOWebModule[R](pac4jSecurity: Pac4jHttpSecurity[R]) extends ZIOWebModule[R]:
   def wrap[C](inner: AuthedZIOWebModule[R, C])(
       toContext: List[CommonProfile] => Option[C],
       clients: Option[String] = Some("OidcClient")
   ): ZIOWebModule[R]

Factory that creates the appropriate AuthenticationService based on configuration.

Reads auth_provider and env from ZIO Config to determine which authentication implementation to use:

• "test": TestAuthenticationService (for testing only, forbidden in production)
• "oidc": Pac4jAuthenticationAdapter (for production OIDC authentication)

Example usage:

 val app = ZIO.serviceWithZIO[AuthenticationService](_.currentUser)
   .provide(AuthenticationServiceFactory.layer)

Configuration for the single page application (SPA) endpoints.

By default, the application will be served from prefix/app path, static resources from prefix/? path.

Under "app", only index.html will be served.

As this has a catch-all route, it should be the last route in the list.