class

PerlAuthTagger

Inherits FrameworkTagger < FileHelper < Tagger < Reference < Object

Identifies authentication / authorization guards in Perl web apps.

Dancer2 leans on Dancer2::Plugin::Auth::Extensible, which guards routes either inline on the declaration:

get '/admin' => require_role Admin => sub { ... }; get '/me' => require_login sub { ... };

or globally through a hook before that calls logged_in_user / redirect. Catalyst and Mojolicious use handler-body checks ($c->user_exists, $c->assert_user_roles, $c->require_login, $self->is_user_authenticated). This tagger surfaces all of them as a single auth tag so reviewers can spot the unprotected routes.

Constants

BODY_PATTERNS = [{/\blogged_in_user\b/, "Dancer2 logged_in_user"}, {/\buser_has_role\b/, "Dancer2 user_has_role"}, {/\bauthenticate_user\b/, "Dancer2 authenticate_user"}, {/->\s*assert_user_roles\b/, "Catalyst assert_user_roles"}, {/->\s*check_user_roles\b/, "Catalyst check_user_roles"}, {/->\s*user_exists\b/, "Catalyst user_exists"}, {/\$c\s*->\s*require_login\b/, "Catalyst require_login"}, {/\$c\s*->\s*authenticate\b/, "Catalyst authenticate"}, {/->\s*is_user_authenticated\b/, "Mojolicious is_user_authenticated"}]

Checks that appear inside the handler body (or a nearby helper).

GLOBAL_GUARD_BLOCK_START = /\bhook\s+before\b|\bbefore\s*=>\s*sub\b|\bsub\s+auto\b|\bsub\s+begin\b/
GLOBAL_GUARD_KEYWORDS = /\brequire_login\b|\brequire_role\b|\blogged_in_user\b|\buser_has_role\b|->\s*authenticate\b|->\s*user_exists\b|->\s*require_login\b|redirect\b.*\blogin\b/

Keywords that make a hook before / Catalyst sub auto block an application-wide guard covering every route in the file.

ROUTE_WRAPPER_PATTERNS = [{/\brequire_all_roles\b/, "Dancer2 require_all_roles"}, {/\brequire_any_role\b/, "Dancer2 require_any_role"}, {/\brequire_role\b/, "Dancer2 require_role"}, {/\brequire_login\b/, "Dancer2 require_login"}]

Inline route wrappers from Dancer2::Plugin::Auth::Extensible. These sit between the path and the sub { ... } on the route declaration.

Class methods

target_techs
Source

Instance methods

perform(endpoints : Array(Endpoint)) : Array(Endpoint)

The per-endpoint shape: look at each endpoint, tag in place, hand the array back. Fifteen framework taggers carried a byte-identical copy of this; they now declare only check_endpoint.

Not every framework tagger fits it — eleven still override perform because they need a pre-scan over the project (config files, middleware registration) before the per-endpoint pass, or they group endpoints first. Those keep their own.

Source