Add support for authorization of HTTP client requests

runtime/bin/http.dart

Index: runtime/bin/http.dart
diff --git a/runtime/bin/http.dart b/runtime/bin/http.dart
index a3f4931c8dc36a568bc6b6d79fcbfa770e163ff4..0fb9b227a73862c60696d97b4a35c286e482d73a 100644
--- a/runtime/bin/http.dart
+++ b/runtime/bin/http.dart
@@ -364,8 +364,9 @@ abstract class HeaderValue {
    * Creates a new header value object from parsing a header value
    * string with both value and optional parameters.
    */
-  factory HeaderValue.fromString(String value) {
-    return new _HeaderValue.fromString(value);
+  factory HeaderValue.fromString(String value,
+                                 [String parameterSeparator = ";"]) {
+    return new _HeaderValue.fromString(value, parameterSeparator);
   }
 
   /**
@@ -709,6 +710,25 @@ abstract class HttpClient {
   HttpClientConnection postUrl(Uri url);
 
   /**
+   * Sets the function to be called when a site is requesting
+   * authentication. The URL requested and the security realm from the
+   * server are passed in the arguments [url] and [realm].
+   *
+   * If credentials exists the function should add these using
+   * [addCredentials] before returning.
+   *
+   * If the function returns true the request will be retried using
+   * the updated credentials. Otherwise response procession will

[Mads Ager (google), 2012/10/17 11:26:43]

procession -> processing?

How about returning an HttpClientCredentials object from authenticate and 
getting rid of the 'addCredentials' method? A [null] could indicate not having
credentials to add. That seems like a simplification for the user.
 

[Anders Johnsen, 2012/10/22 14:01:22]

I agree. The HttpClient should not have any credentials stored internally.

[Søren Gjesse, 2012/10/26 09:43:00]

The reason for having the addCredentials method is to make it possible to add
credentials up-front and not have to deal with using this authenticate callback.
We could have the authenticate callback return the HttpClientCredentials object
to use instead of a boolean.

Maybe a HttpClientCredentials returned here should then be transient and not
added to the credentials store?

[Søren Gjesse, 2012/10/26 09:43:00]

I don't agree here. The HttpClient should have a credentials store, as each
request made needs to have the "Authorization:" header set. If the credentials
are not stored all requests requiring authorization will require an additional
round trip with a status code 401 responses.

+   * continue normally.
+   */
+  set authenticate(bool f(Uri url, String scheme, String realm));
+
+  /**
+   * Add credentials to be used for authorizing HTTP requests.
+   */
+  void addCredentials(Uri url, String realm, HttpClientCredentials credentials);
+
+  /**
    * Sets the function used to resolve the proxy server to be used for
    * opening a HTTP connection to the specified [url]. If this
    * function is not set, direct connections will always be used.
@@ -904,6 +924,28 @@ abstract class HttpClientResponse {
   InputStream get inputStream;
 }
 
+
+abstract class HttpClientCredentials { }
+
+
+/**
+ * Represent credentials for basic authentication.
+ */
+abstract class HttpClientBasicCredentials extends HttpClientCredentials {
+  factory HttpClientBasicCredentials(String username, String password) =>
+      new _HttpClientBasicCredentials(username, password);
+}
+
+
+/**
+ * Represent credentials for digest authentication.
+ */
+abstract class HttpClientDigestCredentials extends HttpClientCredentials {
+  factory HttpClientDigestCredentials(String username, String password) =>
+      new _HttpClientDigestCredentials(username, password);
+}
+
+
 /**
  * Connection information.
  */