+ /** Authenticate the request for the given (method, payload) pair.
+ *
+ * Implementations are expected to provide strong authentication. It is
+ * suggested to use an HMAC-based scheme, where the signature validates the
+ * method, url, and payload (to avoid replay of the signature against other
+ * methods), and the timestamp (to avoid replay in time).
+ *
+ * @param method method of the request (GET, POST, PUT, DELETE)
+ * @param resource URL path of the resource (eg. "/api/user")
+ * @param payload binary payload sent with the request (before decoding)
+ * @return a valid PlUser object if authentication is successfull, or null.
+ */
+ public function apiAuth($method, $resource, $payload)
+ {
+ return null; // Default implementation does nothing
+ }
+
+ /** Check authentication with the given token.
+ *
+ * Token authentication is a light-weight authentication based on a user-specific token.
+ * This can be used for protocols that requires a 'cookie'-free authentication, such as
+ * RSS, iCal registration...
+ *
+ * This function returns a valid user object if authentication is successful, or null if
+ * token mismatch.
+ */
+ abstract public function tokenAuth($login, $token);
+
+ /** Set the permissions to the given flagset.
+ *
+ * This function sets S::set('perms') with a flagset represeting the combination of
+ * $perms and $is_admin.
+ *
+ * $perms is an abstract object representing the permissions.
+ * $is_admin is a boolean, true if the current user has site-administration rights.
+ */
+ abstract protected function makePerms($perms, $is_admin);