{"action":"created","issue":{"url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/188","labels_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/188/labels{/name}","comments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/188/comments","events_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/188/events","html_url":"https://github.com/sandstorm-io/sandstorm/pull/188","id":52306591,"number":188,"title":"Add getUiViewForToken and getExternalWebSession methods to hack-session","user":{"login":"jparyani","id":1595880,"avatar_url":"https://avatars.githubusercontent.com/u/1595880?v=3","gravatar_id":"","url":"https://api.github.com/users/jparyani","html_url":"https://github.com/jparyani","followers_url":"https://api.github.com/users/jparyani/followers","following_url":"https://api.github.com/users/jparyani/following{/other_user}","gists_url":"https://api.github.com/users/jparyani/gists{/gist_id}","starred_url":"https://api.github.com/users/jparyani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jparyani/subscriptions","organizations_url":"https://api.github.com/users/jparyani/orgs","repos_url":"https://api.github.com/users/jparyani/repos","events_url":"https://api.github.com/users/jparyani/events{/privacy}","received_events_url":"https://api.github.com/users/jparyani/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2014-12-17T23:29:17Z","updated_at":"2015-01-07T01:42:58Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/188","html_url":"https://github.com/sandstorm-io/sandstorm/pull/188","diff_url":"https://github.com/sandstorm-io/sandstorm/pull/188.diff","patch_url":"https://github.com/sandstorm-io/sandstorm/pull/188.patch"},"body":"`getUiViewForToken` is pretty straightforward. I just made `getProxyForApiToken` accessible from proxy.js and called that directly. I also added `getApiEndpoint` because I realized I need a way to tell inside an app when a request is hitting the api server and I should be using `getUiViewForToken`. Should this perhaps be hidden from apps and handled seamlessly by the backend?\r\n\r\n`getExternalWebSession` was a little more involved. Mostly it was a reimplementation of parts of sandstorm-http-bridge.c++ in node.js. Do you think we should be passing along cookies, or should they be dropped?"},"comment":{"url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/comments/68966837","html_url":"https://github.com/sandstorm-io/sandstorm/pull/188#issuecomment-68966837","issue_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/188","id":68966837,"user":{"login":"kentonv","id":4001805,"avatar_url":"https://avatars.githubusercontent.com/u/4001805?v=3","gravatar_id":"","url":"https://api.github.com/users/kentonv","html_url":"https://github.com/kentonv","followers_url":"https://api.github.com/users/kentonv/followers","following_url":"https://api.github.com/users/kentonv/following{/other_user}","gists_url":"https://api.github.com/users/kentonv/gists{/gist_id}","starred_url":"https://api.github.com/users/kentonv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kentonv/subscriptions","organizations_url":"https://api.github.com/users/kentonv/orgs","repos_url":"https://api.github.com/users/kentonv/repos","events_url":"https://api.github.com/users/kentonv/events{/privacy}","received_events_url":"https://api.github.com/users/kentonv/received_events","type":"User","site_admin":false},"created_at":"2015-01-07T01:42:58Z","updated_at":"2015-01-07T01:42:58Z","body":"> getUiViewForToken is pretty straightforward. I just made getProxyForApiToken accessible from proxy.js and called that directly. I also added getApiEndpoint because I realized I need a way to tell inside an app when a request is hitting the api server and I should be using getUiViewForToken. Should this perhaps be hidden from apps and handled seamlessly by the backend?\r\n\r\nActually, the correct thing is probably for `getUiViewForToken` to take both the host and token parts of the webkey. It should then automatically loopback when the host matches the local API host and fall back to an HTTP session when remote. Of course, that HTTP session needs to send the appropriate `Authorization` header for the remote server being Sandstorm.\r\n\r\nMaybe what we really want is to replace all three methods that you've added with a single method:\r\n\r\n    getUiViewForEndpoint (url :Text) -> (view :UiView);\r\n\r\nThen:\r\n- If the URL is a local webkey, pass back a capability directly.\r\n- If the URL is a remote webkey (i.e. a different Sandstorm server), set up a WebSession that sends the `Authorization` header correctly. You'll need to wrap it in a dummy `UiView` that only supports `WebSession`. (Some day, we'll connect via Cap'n Proto instead, and actually return the remote `UiView` verbatim.)\r\n- If the URL is not a webkey at all, treat it like `getExternalWebSession`. We should actually allow URLs with a path, BTW -- just prefix each request's path with it.\r\n\r\nWith this approach, apps don't actually have to detect if the address is a webkey at all.\r\n\r\n> getExternalWebSession was a little more involved. Mostly it was a reimplementation of parts of sandstorm-http-bridge.c++ in node.js. Do you think we should be passing along cookies, or should they be dropped?\r\n\r\nPassing cookies is fine, as long as we don't do something silly like automatically pull them out of the user's browser's cookie jar (not that we have any way to do that)."}}