merge all URI handlers into a single dispatch function

src/ESP32React/SecurityManager.h

@@ -6,9 +6,10 @@
 #include <ESPAsyncWebServer.h>
 #include <AsyncJson.h>
 
-#include <list>
+#include <memory>
+#include <vector>
 
-#define ACCESS_TOKEN_PARAMATER "access_token"
+#define ACCESS_TOKEN_PARAMETER "access_token"
 #define AUTHORIZATION_HEADER "Authorization"
 #define AUTHORIZATION_HEADER_PREFIX "Bearer "
 #define AUTHORIZATION_HEADER_PREFIX_LEN 7
@@ -29,20 +30,16 @@ class User {
 
 class Authentication {
   public:
-    User *  user          = nullptr;
-    boolean authenticated = false;
+    std::unique_ptr<User> user;
+    boolean               authenticated = false;
 
   public:
-    explicit Authentication(const User & user)
-        : user(new User(user))
+    explicit Authentication(const User & u)
+        : user(std::make_unique<User>(u))
         , authenticated(true) {
     }
 
     Authentication() = default;
-
-    ~Authentication() {
-        delete user;
-    }
 };
 
 typedef std::function<boolean(Authentication & authentication)> AuthenticationPredicate;
@@ -63,6 +60,8 @@ class AuthenticationPredicates {
 
 class SecurityManager {
   public:
+    virtual ~SecurityManager() = default;
+
     // Authenticate, returning the user if found
     virtual Authentication authenticate(const String & username, const String & password) = 0;
 
@@ -72,40 +71,70 @@ class SecurityManager {
     // Check the request header for the Authorization token
     virtual Authentication authenticateRequest(AsyncWebServerRequest * request) = 0;
 
-    // Filter a request with the provided predicate, only returning true if the predicate matches.
-    virtual ArRequestFilterFunction filterRequest(AuthenticationPredicate predicate) = 0;
-
-    // Wrap the provided request to provide validation against an AuthenticationPredicate.
-    virtual ArRequestHandlerFunction wrapRequest(ArRequestHandlerFunction onRequest, AuthenticationPredicate predicate) = 0;
-
-    // Wrap the provided json request callback to provide validation against an AuthenticationPredicate.
-    virtual ArJsonRequestHandlerFunction wrapCallback(ArJsonRequestHandlerFunction onRequest, AuthenticationPredicate predicate) = 0;
-
-    // Json endpoints - default POST
+    // Json endpoints - default POST. Registered with the shared dispatcher.
     void addEndpoint(AsyncWebServer *             server,
                      const String &               path,
                      AuthenticationPredicate      predicate,
                      ArJsonRequestHandlerFunction function,
-                     WebRequestMethodComposite    method = HTTP_POST) {
-        auto handler = new AsyncCallbackJsonWebHandler(path);
-        handler->onRequest(
-            wrapCallback([this, function](AsyncWebServerRequest * request, JsonVariant json) { function(request, json); }, AuthenticationPredicates::IS_ADMIN));
-        handler->setMethod(method);
-        server->addHandler(handler);
-    }
+                     WebRequestMethodComposite    method = HTTP_POST);
 
-    // non-Json endpoints - default GET
+    // non-Json endpoints - default GET. Registered with the shared dispatcher.
     void addEndpoint(AsyncWebServer *          server,
                      const String &            path,
                      AuthenticationPredicate   predicate,
                      ArRequestHandlerFunction  function,
-                     WebRequestMethodComposite method = HTTP_GET) {
-        auto * handler = new AsyncCallbackWebHandler();
-        handler->onRequest(wrapRequest([this, function](AsyncWebServerRequest * request) { function(request); }, predicate));
-        handler->setUri(path);
-        handler->setMethod(method);
-        server->addHandler(handler);
-    }
+                     WebRequestMethodComposite method = HTTP_GET);
+
+  private:
+    // Single internal route record. Each route holds either a plain or JSON handler.
+    // The URI matcher uses backward-compatible mode by default (constructed from a
+    // plain String), which preserves the original library handler's matching semantics
+    // (e.g. /api also matches /api/boiler/heating).
+    struct RestRoute {
+        AsyncURIMatcher              uri;
+        WebRequestMethodComposite    method;
+        AuthenticationPredicate      predicate;
+        ArRequestHandlerFunction     plainHandler;
+        ArJsonRequestHandlerFunction jsonHandler;
+        bool                         isJson;
+        bool                         requiresAuth; // false when predicate is NONE_REQUIRED, lets dispatchRest skip the JWT parse
+    };
+
+    // Single catch-all handler. canHandle() claims a request only if some registered
+    // route matches its URI + method, so non-matching URLs (static files, websockets,
+    // etc.) still fall through to other handlers. handleBody buffers JSON bodies, then
+    // handleRequest hands off to SecurityManager::dispatchRest for routing + auth.
+    //
+    // We can't reuse AsyncCallbackJsonWebHandler here because its canHandle() rejects
+    // POST/PUT/PATCH without an application/json content-type (so a bodyless POST like
+    // /rest/resetCustomizations would fall through to a 404), and both canHandle and
+    // handleRequest are marked final on that class.
+    class RestCatchAllHandler : public AsyncWebHandler {
+      public:
+        explicit RestCatchAllHandler(SecurityManager * owner)
+            : _owner(owner) {
+        }
+
+        bool canHandle(AsyncWebServerRequest * request) const override;
+        bool isRequestHandlerTrivial() const override;
+        void handleBody(AsyncWebServerRequest * request, uint8_t * data, size_t len, size_t index, size_t total) override;
+        void handleRequest(AsyncWebServerRequest * request) override;
+
+      private:
+        static constexpr size_t kMaxBodySize = 16384;
+
+        static bool isJsonContent(AsyncWebServerRequest * request);
+
+        SecurityManager * _owner;
+    };
+
+    static bool isPublicPredicate(const AuthenticationPredicate & predicate);
+
+    void ensureRestDispatcher(AsyncWebServer * server);
+    void dispatchRest(AsyncWebServerRequest * request, JsonVariant json);
+
+    std::vector<RestRoute> _restRoutes;
+    bool                   _restDispatcherInstalled = false;
 };
 
 #endif