X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=classes%2Fplsession.php;h=f19c4572fcae0bf6abe9e9d1c07a5f50f0d677ca;hb=31dc3dd3cdae22485061c3a1b6accdd732207dd4;hp=7a243be44ebb552b153cc45a8c9013e46907fdc3;hpb=663c7f8e9bdc2d3d3f36ad25a63e62913f3b25ce;p=platal.git

diff --git a/classes/plsession.php b/classes/plsession.php
index 7a243be..f19c457 100644
--- a/classes/plsession.php
+++ b/classes/plsession.php
@@ -1,6 +1,6 @@
 <?php
 /***************************************************************************
- *  Copyright (C) 2003-2010 Polytechnique.org                              *
+ *  Copyright (C) 2003-2011 Polytechnique.org                              *
  *  http://opensource.polytechnique.org/                                   *
  *                                                                         *
  *  This program is free software; you can redistribute it and/or modify   *
@@ -159,6 +159,23 @@ abstract class PlSession
      */
     abstract protected function startSessionAs($user, $level);
 
+    /** Authenticate the request for the given (method, payload) pair.
+     *
+     * Implementations are expected to provide strong authentication. It is
+     * suggested to use an HMAC-based scheme, where the signature validates the
+     * method, url, and payload (to avoid replay of the signature against other
+     * methods), and the timestamp (to avoid replay in time).
+     *
+     * @param method method of the request (GET, POST, PUT, DELETE)
+     * @param resource URL path of the resource (eg. "/api/user")
+     * @param payload binary payload sent with the request (before decoding)
+     * @return a valid PlUser object if authentication is successfull, or null.
+     */
+    public function apiAuth($method, $resource, $payload)
+    {
+        return null;  // Default implementation does nothing
+    }
+
     /** Check authentication with the given token.
      *
      * Token authentication is a light-weight authentication based on a user-specific token.