使用 Play 实现 Web 开发，第 1 部分: 使用 Play Framework 和 Scala 管理用户身份验证

Play 的可伸缩性

通过使用异步 I/O，Play 采取了一种编程模型，其中应用程序代码对在 I/O 完成时触发的事件做出反应。在此期间，运行应用程序代码的线程不会拦截，而能够处理其他请求。此设计支持高效地使用处理器核心：Play 可使用少量线程处理大量的流量。而且 Play 不会存储任何服务器端会话状态，它通过消除会话亲缘性而帮助实现了水平可伸缩性：集群中的任何服务器都可受理一个请求。

Play 的应用

采用 Play 的公司包括 LinkedIn、Klout 和 Coursera。撰写本文时，该项目在 GitHub 上已有 2,411 个分支，Stack Overflow 上有 10,308 个带 playframework 标记的问题。

play.modules.enabled += "play.modules.reactivemongo.ReactiveMongoModule" play.modules.enabled += "module.Module"  mongodb.uri = "mongodb://localhost:27017/demodb"  mail.from="dwplaydemo <mailrobot@dwplaydemo.net>" mail.reply="No reply <noreply@dwplaydemo.net>"  play.mailer {   mock = true   host = localhost }  play.http.filters = "utils.Filters" play.http.errorHandler = "utils.ErrorHandler"  include "silhouette.conf"

# Application GET     /                           controllers.Application.index GET     /profile                    controllers.Application.profile  # Rest api GET     /rest/profile               controllers.RestApi.profile  # Public assets GET     /assets/*file               controllers.Assets.versioned(path="/public", file: Asset) GET     /webjars/*file              controllers.WebJarAssets.at(file)

GET     /auth/signup                controllers.Auth.startSignUp POST    /auth/signup                controllers.Auth.handleStartSignUp GET     /auth/signup/:token         controllers.Auth.signUp(token:String)  GET     /auth/reset                 controllers.Auth.startResetPassword POST    /auth/reset                 controllers.Auth.handleStartResetPassword GET     /auth/reset/:token          controllers.Auth.resetPassword(token:String) POST    /auth/reset/:token          controllers.Auth.handleResetPassword(token:String)  GET     /auth/signin                controllers.Auth.signIn POST    /auth/authenticate          controllers.Auth.authenticate GET     /auth/social/:providerId    controllers.Auth.socialAuthenticate(providerId:String) GET     /auth/signout               controllers.Auth.signOut

case class Profile(   loginInfo:LoginInfo,   confirmed: Boolean,   email:Option[String],   firstName: Option[String],    lastName: Option[String],   fullName: Option[String],    passwordInfo:Option[PasswordInfo],    oauth1Info: Option[OAuth1Info],   avatarUrl: Option[String])  case class User(id: UUID, profiles: List[Profile]) extends Identity {   def profileFor(loginInfo:LoginInfo) = profiles.find(_.loginInfo == loginInfo)   def fullName(loginInfo:LoginInfo) = profileFor(loginInfo).flatMap(_.fullName) }  object User {   implicit val passwordInfoJsonFormat = Json.format[PasswordInfo]   implicit val oauth1InfoJsonFormat = Json.format[OAuth1Info]   implicit val profileJsonFormat = Json.format[Profile]   implicit val userJsonFormat = Json.format[User] }

trait UserDao {   def save(user:User):Future[User]   def find(loginInfo:LoginInfo):Future[Option[User]]   def find(userId:UUID):Future[Option[User]]   def confirm(loginInfo:LoginInfo):Future[User]   def link(user:User, profile:Profile):Future[User]   def update(profile:Profile):Future[User] }

class MongoUserDao extends UserDao {   lazy val reactiveMongoApi = current.injector.instanceOf[ReactiveMongoApi]   val users = reactiveMongoApi.db.collection[JSONCollection]("users")    def find(loginInfo:LoginInfo):Future[Option[User]] =      users.find(Json.obj("profiles.loginInfo" -> loginInfo)).one[User]    def find(userId:UUID):Future[Option[User]] =     users.find(Json.obj("id" -> userId)).one[User]      def save(user:User):Future[User] =     users.insert(user).map(_ => user)    def confirm(loginInfo:LoginInfo):Future[User] = for {     _ <- users.update(Json.obj(       "profiles.loginInfo" -> loginInfo     ), Json.obj("$set" -> Json.obj("profiles.$.confirmed" -> true)))     user <- find(loginInfo)   } yield user.get    def link(user:User, profile:Profile) = for {     _ <- users.update(Json.obj(       "id" -> user.id     ), Json.obj("$push" -> Json.obj("profiles" -> profile)))     user <- find(user.id)   } yield user.get    def update(profile:Profile) = for {     _ <- users.update(Json.obj(       "profiles.loginInfo" -> profile.loginInfo     ), Json.obj("$set" -> Json.obj("profiles.$" -> profile)))     user <- find(profile.loginInfo)   } yield user.get }

def fakeApp = FakeApplication(additionalConfiguration =       Map("mongodb.uri" -> "mongodb://localhost:27017/test"))  def withUserDao[T](t:MongoUserDao => T):T = running(fakeApp) {   val userDao = new MongoUserDao   Await.ready(userDao.users.drop(), timeout)   t(userDao) }

"UserDao" should {   "save users and find them by userId" in withUserDao { userDao =>     val future = for {       _ <- userDao.save(credentialsTestUser)       maybeUser <- userDao.find(credentialsTestUser.id)     } yield maybeUser.map(_ == credentialsTestUser)     Await.result(future, timeout) must beSome(true)   } }

class UserService @Inject() (userDao:UserDao) extends IdentityService[User] {   def retrieve(loginInfo:LoginInfo) = userDao.find(loginInfo)   def save(user:User) = userDao.save(user)   def find(id:UUID) = userDao.find(id)   def confirm(loginInfo:LoginInfo) = userDao.confirm(loginInfo)   def link(user:User, socialProfile:CommonSocialProfile) = {     val profile = toProfile(socialProfile)     if (user.profiles.exists(_.loginInfo == profile.loginInfo))        Future.successful(user) else userDao.link(user, profile)   }    def save(socialProfile:CommonSocialProfile) = {     val profile = toProfile(socialProfile)     userDao.find(profile.loginInfo).flatMap {       case None => userDao.save(User(UUID.randomUUID(), List(profile)))       case Some(user) => userDao.update(profile)     }   }    private def toProfile(p:CommonSocialProfile) = Profile(     loginInfo = p.loginInfo,     confirmed = true,     email = p.email,     firstName = p.firstName,     lastName = p.lastName,     fullName = p.fullName,     passwordInfo = None,     oauth1Info = None,     avatarUrl = p.avatarURL   ) }

case class UserToken(id:UUID, userId:UUID, email:String, expirationTime:DateTime, isSignUp:Boolean) {   def isExpired = expirationTime.isBeforeNow }  object UserToken {   implicit val toJson = Json.format[UserToken]      def create(userId:UUID, email:String, isSignUp:Boolean) =      UserToken(UUID.randomUUID(), userId, email, new DateTime().plusHours(12), isSignUp) }

class UserTokenService @Inject() (userTokenDao:UserTokenDao) {   def find(id:UUID) = userTokenDao.find(id)   def save(token:UserToken) = userTokenDao.save(token)   def remove(id:UUID) = userTokenDao.remove(id) }

注意您的 Play 版本

从 2.4.0 版开始，Play Framework 框架采用了依赖注入作为一种内置机制。旧版本采用了完全不同的机制来将参数传递给控制器。一些库仍无法用于 Play 2.4.x。由于 Play 相对未成熟，主要版本之间的变化可能非常大。

class Module extends AbstractModule with ScalaModule {    def configure() {     bind[IdentityService[User]].to[UserService]     bind[UserDao].to[MongoUserDao]     bind[UserTokenDao].to[MongoUserTokenDao]     bind[DelegableAuthInfoDAO[PasswordInfo]].to[PasswordInfoDao]     bind[DelegableAuthInfoDAO[OAuth1Info]].to[OAuth1InfoDao]     bind[IDGenerator].toInstance(new SecureRandomIDGenerator())     bind[PasswordHasher].toInstance(new BCryptPasswordHasher)     bind[FingerprintGenerator].toInstance(new DefaultFingerprintGenerator(false))     bind[EventBus].toInstance(EventBus())     bind[Clock].toInstance(Clock())   }      // ... Bindings for Silhouette components follow }

@Provides def provideEnvironment(     identityService: IdentityService[User],     authenticatorService: AuthenticatorService[CookieAuthenticator],     eventBus: EventBus): Environment[User, CookieAuthenticator] = {   Environment[User, CookieAuthenticator](identityService, authenticatorService, Seq(), eventBus) }  @Provides def provideAuthenticatorService(     fingerprintGenerator: FingerprintGenerator,     idGenerator: IDGenerator,     configuration: Configuration,     clock: Clock): AuthenticatorService[CookieAuthenticator] = {   val config = configuration.underlying.as[CookieAuthenticatorSettings]("silhouette.authenticator")   new CookieAuthenticatorService(config, None, fingerprintGenerator, idGenerator, clock) }  @Provides def provideCredentialsProvider(     authInfoRepository: AuthInfoRepository,     passwordHasher: PasswordHasher): CredentialsProvider = {   new CredentialsProvider(authInfoRepository, passwordHasher, Seq(passwordHasher)) }  @Provides def provideAuthInfoRepository(   passwordInfoDAO: DelegableAuthInfoDAO[PasswordInfo],   oauth1InfoDAO: DelegableAuthInfoDAO[OAuth1Info]): AuthInfoRepository = {    new DelegableAuthInfoRepository(passwordInfoDAO, oauth1InfoDAO) }  @Provides def provideTwitterProvider(     httpLayer: HTTPLayer,     tokenSecretProvider: OAuth1TokenSecretProvider,     configuration: Configuration): TwitterProvider = {   val settings = configuration.underlying.as[OAuth1Settings]("silhouette.twitter")   new TwitterProvider(httpLayer, new PlayOAuth1Service(settings), tokenSecretProvider, settings) }  @Provides def provideOAuth1TokenSecretProvider(     configuration: Configuration, clock: Clock): OAuth1TokenSecretProvider = {   val cfg = configuration.underlying.as[CookieSecretSettings]("silhouette.oauth1TokenSecretProvider")   new CookieSecretProvider(cfg, clock) }  @Provides def provideSocialProviderRegistry(     twitterProvider: TwitterProvider): SocialProviderRegistry = {   SocialProviderRegistry(Seq(twitterProvider)) }

authenticator.cookieName="authenticator" authenticator.cookiePath="/" authenticator.secureCookie=false authenticator.httpOnlyCookie=true authenticator.useFingerprinting=true authenticator.authenticatorIdleTimeout=30 minutes authenticator.authenticatorExpiry=12 hours  oauth1TokenSecretProvider.cookieName="OAuth1TokenSecret" oauth1TokenSecretProvider.cookiePath="/" oauth1TokenSecretProvider.secureCookie=false oauth1TokenSecretProvider.httpOnlyCookie=true oauth1TokenSecretProvider.expirationTime=5 minutes  twitter.requestTokenURL="https://api.twitter.com/oauth/request_token" twitter.accessTokenURL="https://api.twitter.com/oauth/access_token" twitter.authorizationURL="https://api.twitter.com/oauth/authorize" twitter.callbackURL="http://dwdemo.com:9000/auth/social/twitter" twitter.consumerKey=${?TWITTER_CONSUMER_KEY} twitter.consumerSecret=${?TWITTER_CONSUMER_SECRET}

class Auth @Inject() (   val messagesApi: MessagesApi,    val env:Environment[User,CookieAuthenticator],   socialProviderRegistry: SocialProviderRegistry,   authInfoRepository: AuthInfoRepository,   credentialsProvider: CredentialsProvider,   userService: UserService,   userTokenService: UserTokenService,   avatarService: AvatarService,   passwordHasher: PasswordHasher,   configuration: Configuration,   mailer: Mailer) extends Silhouette[User,CookieAuthenticator] {        // ... auth controller code ... }

def startSignUp = UserAwareAction.async { implicit request =>   Future.successful(request.identity match {     case Some(user) => Redirect(routes.Application.index)     case None => Ok(views.html.auth.startSignUp(signUpForm))   }) }

def handleStartSignUp = Action.async { implicit request =>   signUpForm.bindFromRequest.fold(     bogusForm => Future.successful(BadRequest(views.html.auth.startSignUp(bogusForm))),     signUpData => {       val loginInfo = LoginInfo(CredentialsProvider.ID, signUpData.email)       userService.retrieve(loginInfo).flatMap {         case Some(_) =>            Future.successful(Redirect(routes.Auth.startSignUp()).flashing(             "error" -> Messages("error.userExists", signUpData.email)))         case None =>            val profile = Profile(             loginInfo = loginInfo, confirmed=false, email=Some(signUpData.email),              firstName=Some(signUpData.firstName), lastName=Some(signUpData.lastName),              fullName=Some(s"${signUpData.firstName} ${signUpData.lastName}"),             passwordInfo = None, oauth1Info = None, avatarUrl = None)           for {             avatarUrl <- avatarService.retrieveURL(signUpData.email)             user <- userService.save(User(id = UUID.randomUUID(),               profiles = List(profile.copy(avatarUrl = avatarUrl))))             _ <- authInfoRepository.add(loginInfo, passwordHasher.hash(signUpData.password))             token <- userTokenService.save(UserToken.create(user.id, signUpData.email, true))           } yield {             mailer.welcome(profile, link = routes.Auth.signUp(token.id.toString).absoluteURL())             Ok(views.html.auth.finishSignUp(profile))           }       }     }   ) }

def signUp(tokenId:String) = Action.async { implicit request =>   val id = UUID.fromString(tokenId)   userTokenService.find(id).flatMap {     case None =>        Future.successful(NotFound(views.html.errors.notFound(request)))     case Some(token) if token.isSignUp && !token.isExpired =>        userService.find(token.userId).flatMap {         case None => Future.failed(new IdentityNotFoundException(Messages("error.noUser")))         case Some(user) =>            val loginInfo = LoginInfo(CredentialsProvider.ID, token.email)           for {             authenticator <- env.authenticatorService.create(loginInfo)             value <- env.authenticatorService.init(authenticator)             _ <- userService.confirm(loginInfo)             _ <- userTokenService.remove(id)             result <- env.authenticatorService.embed(value, Redirect(routes.Application.index()))           } yield result       }     case Some(token) =>        userTokenService.remove(id).map {_ => NotFound(views.html.errors.notFound(request))}   } }

def authenticate = Action.async { implicit request =>   signInForm.bindFromRequest.fold(     bogusForm => Future.successful(       BadRequest(views.html.auth.signIn(bogusForm, socialProviderRegistry))),     signInData => {       val credentials = Credentials(signInData.email, signInData.password)       credentialsProvider.authenticate(credentials).flatMap { loginInfo =>          userService.retrieve(loginInfo).flatMap {           case None =>              Future.successful(Redirect(routes.Auth.signIn())               .flashing("error" -> Messages("error.noUser")))           case Some(user) if !user.profileFor(loginInfo).map(_.confirmed).getOrElse(false) =>             Future.successful(Redirect(routes.Auth.signIn())               .flashing("error" -> Messages("error.unregistered", signInData.email)))           case Some(_) => for {             authenticator <- env.authenticatorService.create(loginInfo).map {                case authenticator if signInData.rememberMe => authenticator.copy(...) // Extend lifetime               case authenticator => authenticator             }             value <- env.authenticatorService.init(authenticator)             result <- env.authenticatorService.embed(value, Redirect(routes.Application.index()))           } yield result         }       }.recover {         case e:ProviderException =>            Redirect(routes.Auth.signIn()).flashing("error" -> Messages("error.invalidCredentials"))       }     }   ) }

def socialAuthenticate(providerId:String) = UserAwareAction.async { implicit request =>   (socialProviderRegistry.get[SocialProvider](providerId) match {     case Some(p:SocialProvider with CommonSocialProfileBuilder) => p.authenticate.flatMap {       case Left(result) => Future.successful(result)       case Right(authInfo) => for {         profile <- p.retrieveProfile(authInfo)         user <- request.identity.fold(userService.save(profile))(userService.link(_,profile))         authInfo <- authInfoRepository.save(profile.loginInfo, authInfo)         authenticator <- env.authenticatorService.create(profile.loginInfo)         value <- env.authenticatorService.init(authenticator)         result <- env.authenticatorService.embed(value, Redirect(routes.Application.index()))       } yield result     }      case _ => Future.successful(       Redirect(request.identity.fold(routes.Auth.signIn())(_ => routes.Application.profile()))      .flashing("error" -> Messages("error.noProvider", providerId))     )   }).recover {     case e:ProviderException =>        logger.error("Provider error", e)       Redirect(request.identity.fold(routes.Auth.signIn())(_ => routes.Application.profile()))         .flashing("error" -> Messages("error.notAuthenticated", providerId))   } }

class RestApi @Inject() (   val messagesApi: MessagesApi,    val env:Environment[User,CookieAuthenticator]) extends Silhouette[User,CookieAuthenticator] {    def profile = SecuredAction.async { implicit request =>     val json = Json.toJson(request.identity.profileFor(request.authenticator.loginInfo).get)     val prunedJson = json.transform(       (__ / 'loginInfo).json.prune andThen        (__ / 'passordInfo).json.prune andThen        (__ / 'oauth1Info).json.prune)     prunedJson.fold(       _ => Future.successful(InternalServerError(Json.obj("error" -> Messages("error.profileError")))),       js => Future.successful(Ok(js))     )   }    override def onNotAuthenticated(request:RequestHeader) = {     Some(Future.successful(Unauthorized(Json.obj("error" -> Messages("error.profileUnauth")))))   } }