Introduce RBAC checking via custom authHandler function

[DivergentEuropeans]

PR (2 of 2)
PR 1: zowe/zss#281

Signed-off-by: Leanid Astrakou [email protected]

[lchudinov]

The code is questionable because it introduces a dependency on zss by calling functions defined there.

Could we introduce int registerHttpMiddleware(HttpServer *server, HttpMiddleware *middleware); where HttpMiddleware has a pointer to a callback that HttpServer would call at the beginning of serveRequest function. Here is a propotype:

typedef bool (*MiddlewareCallback)(HttpServer *server, HttpResponse *response, HttpMiddleware *middleware);

typedef struct HttpMiddleware {
  HttpMiddlewareCallback middlewareFunction;
  ///...
  HttpMIddleware *next;
} HttpMiddleware;

struct HttpServer {
  //...
  HttpMiddleware *middlewareList; // list of middleware
}
// in zss
HttpMiddleware *middleware = makeMiddleware(...);
middleware->middlewareFunction = myFunction;
registerHttpMiddleware(server, middleware);

Edit (@DivergentEuropeans ) : This has now been addressed

[ifakhrutdinov]

lgtm, @lchudinov please also have a look, I think you're more familiar with the changes and the goals of those changes

[ifakhrutdinov]

lgtm, @rocketjared, perhaps you're interested in these changes.

@lchudinov, please re-review, it's always good to go over changes related to security multiple times

[ifakhrutdinov]

A nit: you could've used first/last pointers to do O(1) insertion:

if (server->firstAuthHandler) {
  server->lastAuthHandler->next = handler;
} else {
  server->firstAuthHandler = handler;
}
server->lastAuthHandler = handler;

Or if you don't care about the current order:

handler->next = server->authorizationHandlerList;
server->authorizationHandlerList = handler;

[lchudinov]

The implementation not so critical for now as we have only one authorization handler. It can be improved in the future when we for sure know what we want to optimize.