Make check_hash controller agnostic

[danielorihuela]

I'm currently playing with the crate and it's very easy and works as expected. Congratulations! However, I found something strange. I'm forced to set up a prefix for the controller in order to call check_hash. For example, if you want to check the key from the backend side, you wouldn't have to add a prefix. You just want to verify that the hash matches. The prefix is not relevant in that use case.

I don't know if this is expected to be like that but seems odd.

A possible solution would be to have a VerifierController implementing a configure function which returns a ControllerBuilder with the prefix set to an empty string.
Another possible solution would be to add a new function configure_verifier for PrefixedApiKeyController that returns a ControllerBuilder with the prefix set to an empty string.

If this is really an issue and you are open to modifications, I would suggest the second option. It's a simple helper function that won't have big impact in your codebase. If you are open to PR, I'm willing to implement it.

Thank you! @brahmlower

[brahmlower]

Hey @danielorihuela! Sorry for the slow response- it's been a hectic few days. Thanks btw for the feedback on the crate, I really appreciate it 😁

The behavior you're describing is expected as far as the implementation goes (so not a technical bug), but it is unintentionally clunky so I'd definitely call that a product bug lol.

Just to make sure I understand everything correctly, is root desire
a) that you'd like to configure a PrefixedApiKeyController without a prefix, or
b) that you'd like to verify a PAK that has no prefix using a PrefixedApiKeyController that has a non-empty prefix?

Thanks!

[danielorihuela]

Hi!!! Don't worry about the delay. It happens.

Option A is what I want. It's a bit inconvenient to be forced to add a prefix even for checking a key. Not because it's hard, but because it's a bit confusing. "Why do I need the prefix to verify the hash of the long token?"
Imagine I'm on a backend where I only need to verify keys, but I never create them. In that specific use case, adding the "prefix" is forced but irrelevant.

let controller = PrefixedApiKeyController::configure()
        // Prefix is not relevant verifying the hash, but the library forces to set a value
        .prefix("".to_owned())
        .seam_defaults()
        .finalize()
        .expect("Configuration is correct");

controller.check_hash(&api_key, &state.api_key.long_token_hash)

My proposal would be to have something like

let controller = PrefixedApiKeyController::configure_verifier()
        .seam_defaults()
        .finalize()
        .expect("Configuration is correct");

controller.check_hash(&api_key, &state.api_key.long_token_hash)

I hope this makes things much more clear now. Thank you!!!