Add support for authorization of HTTP client requests

runtime/bin/http.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 /**
  * HTTP status codes.
  */
 abstract class HttpStatus {
   static const int CONTINUE = 100;
   static const int SWITCHING_PROTOCOLS = 101;
@@ skipping 346 matching lines @@
 abstract class HeaderValue {
   /**
    * Creates a new header value object setting the value part.
    */
   factory HeaderValue([String value = ""]) => new _HeaderValue(value);
 
   /**
    * Creates a new header value object from parsing a header value
    * string with both value and optional parameters.
    */
-  factory HeaderValue.fromString(String value) {
-    return new _HeaderValue.fromString(value);
+  factory HeaderValue.fromString(String value,
+                                 [String parameterSeparator = ";"]) {
+    return new _HeaderValue.fromString(value, parameterSeparator);
   }
 
   /**
    * Gets and sets the header value.
    */
   String value;
 
   /**
    * Gets the map of parameters.
    */
@@ skipping 323 matching lines @@
    * Opens a HTTP connection using the POST method. See [open] for details.
    */
   HttpClientConnection post(String host, int port, String path);
 
   /**
    * Opens a HTTP connection using the POST method. See [openUrl] for details.
    */
   HttpClientConnection postUrl(Uri url);
 
   /**
+   * Sets the function to be called when a site is requesting
+   * authentication. The URL requested and the security realm from the
+   * server are passed in the arguments [url] and [realm].
+   *
+   * If credentials exists the function should add these using
+   * [addCredentials] before returning.
+   *
+   * If the function returns true the request will be retried using
+   * the updated credentials. Otherwise response procession will

[Mads Ager (google), 2012/10/17 11:26:43]

procession -> processing?

How about returning an HttpClientCredentials object from authenticate and 
getting rid of the 'addCredentials' method? A [null] could indicate not having
credentials to add. That seems like a simplification for the user.
 

[Anders Johnsen, 2012/10/22 14:01:22]

I agree. The HttpClient should not have any credentials stored internally.

[Søren Gjesse, 2012/10/26 09:43:00]

The reason for having the addCredentials method is to make it possible to add
credentials up-front and not have to deal with using this authenticate callback.
We could have the authenticate callback return the HttpClientCredentials object
to use instead of a boolean.

Maybe a HttpClientCredentials returned here should then be transient and not
added to the credentials store?

[Søren Gjesse, 2012/10/26 09:43:00]

I don't agree here. The HttpClient should have a credentials store, as each
request made needs to have the "Authorization:" header set. If the credentials
are not stored all requests requiring authorization will require an additional
round trip with a status code 401 responses.

+   * continue normally.
+   */
+  set authenticate(bool f(Uri url, String scheme, String realm));
+
+  /**
+   * Add credentials to be used for authorizing HTTP requests.
+   */
+  void addCredentials(Uri url, String realm, HttpClientCredentials credentials);
+
+  /**
    * Sets the function used to resolve the proxy server to be used for
    * opening a HTTP connection to the specified [url]. If this
    * function is not set, direct connections will always be used.
    *
    * The string returned by [f] must be in the format used by browser
    * PAC (proxy auto-config) scripts. That is either
    *
    *   "DIRECT"
    *
    * for using a direct connection or
@@ skipping 175 matching lines @@
    */
   List<Cookie> get cookies;
 
   /**
    * Returns the input stream for the response. This is used to read
    * the response data.
    */
   InputStream get inputStream;
 }
 
+
+abstract class HttpClientCredentials { }
+
+
+/**
+ * Represent credentials for basic authentication.
+ */
+abstract class HttpClientBasicCredentials extends HttpClientCredentials {
+  factory HttpClientBasicCredentials(String username, String password) =>
+      new _HttpClientBasicCredentials(username, password);
+}
+
+
+/**
+ * Represent credentials for digest authentication.
+ */
+abstract class HttpClientDigestCredentials extends HttpClientCredentials {
+  factory HttpClientDigestCredentials(String username, String password) =>
+      new _HttpClientDigestCredentials(username, password);
+}
+
+
 /**
  * Connection information.
  */
 abstract class HttpConnectionInfo {
   String get remoteHost;
   int get remotePort;
   int get localPort;
 }
 
 
@@ skipping 48 matching lines @@
 class RedirectLimitExceededException extends RedirectException {
   const RedirectLimitExceededException(List<RedirectInfo> redirects)
       : super("Redirect limit exceeded", redirects);
 }
 
 
 class RedirectLoopException extends RedirectException {
   const RedirectLoopException(List<RedirectInfo> redirects)
       : super("Redirect loop detected", redirects);
 }