Today, idents are completed with a middleware, and if an ident is not found with GET_IDENT the ident is simply removed. This may stop an ident from access something it shouldn't, but for incoming actions, we will have already told the transporter that the action is authenticated and by remove it later, the transporter is not given a chance to handle an unknown ident in the right way.
So to supplement, and in some cases replace, the completion middleware, there should be an option to complete the ident when it's first authenticated on an incoming action. If GET_IDENT returns no matching ident, we can respond with noaccess right away. This should happen in the authenticate() callback given to the transporter when listen() is first called.
The completed ident should be marked with isCompleted as in the completer middleware, to avoid it being completed by the middleware too.
Today, idents are completed with a middleware, and if an ident is not found with
GET_IDENT
the ident is simply removed. This may stop an ident from access something it shouldn't, but for incoming actions, we will have already told the transporter that the action is authenticated and by remove it later, the transporter is not given a chance to handle an unknown ident in the right way.So to supplement, and in some cases replace, the completion middleware, there should be an option to complete the ident when it's first authenticated on an incoming action. If
GET_IDENT
returns no matching ident, we can respond withnoaccess
right away. This should happen in theauthenticate()
callback given to the transporter whenlisten()
is first called.The completed ident should be marked with
isCompleted
as in the completer middleware, to avoid it being completed by the middleware too.