X-Git-Url: https://gerrit.automotivelinux.org/gerrit/gitweb?a=blobdiff_plain;f=src%2Fafb-hreq.c;h=7e3d7ceb9f38591fc08b73c7c4a358c4de97f738;hb=65353dce81a629e042800bb7b86fcd869a76727e;hp=4239670de8149a5b74ea09fb35972539096a277f;hpb=9d59db317f2ac51c3eb058fe740bd39b3021fbcd;p=src%2Fapp-framework-binder.git

diff --git a/src/afb-hreq.c b/src/afb-hreq.c
index 4239670d..7e3d7ceb 100644
--- a/src/afb-hreq.c
+++ b/src/afb-hreq.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016 "IoT.bzh"
+ * Copyright (C) 2015-2020 "IoT.bzh"
  * Author: José Bollo <jose.bollo@iot.bzh>
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -20,6 +20,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
+#include <ctype.h>
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -27,21 +28,29 @@
 
 #include <microhttpd.h>
 #include <json-c/json.h>
+#if !defined(JSON_C_TO_STRING_NOSLASHESCAPE)
+#define JSON_C_TO_STRING_NOSLASHESCAPE 0
+#endif
 
 #if defined(USE_MAGIC_MIME_TYPE)
 #include <magic.h>
 #endif
 
 #include "afb-method.h"
-#include <afb/afb-req-itf.h>
 #include "afb-msg-json.h"
 #include "afb-context.h"
 #include "afb-hreq.h"
-#include "session.h"
+#include "afb-hsrv.h"
+#include "afb-session.h"
+#include "afb-token.h"
+#include "afb-error-text.h"
 #include "verbose.h"
+#include "locale-root.h"
 
 #define SIZE_RESPONSE_BUFFER   8192
 
+static int global_reqids = 0;
+
 static char empty_string[] = "";
 
 static const char long_key_for_uuid[] = "x-afb-uuid";
@@ -53,6 +62,9 @@ static const char short_key_for_token[] = "token";
 static const char long_key_for_reqid[] = "x-afb-reqid";
 static const char short_key_for_reqid[] = "reqid";
 
+static const char key_for_bearer[] = "Bearer";
+static const char key_for_access_token[] = "access_token";
+
 static char *cookie_name = NULL;
 static char *cookie_setter = NULL;
 static char *tmp_pattern = NULL;
@@ -68,26 +80,16 @@ struct hreq_data {
 	char *path;		/* path of the file saved */
 };
 
-static struct json_object *req_json(struct afb_hreq *hreq);
-static struct afb_arg req_get(struct afb_hreq *hreq, const char *name);
-static void req_fail(struct afb_hreq *hreq, const char *status, const char *info);
-static void req_success(struct afb_hreq *hreq, json_object *obj, const char *info);
-static const char *req_raw(struct afb_hreq *hreq, size_t *size);
-static void req_send(struct afb_hreq *hreq, const char *buffer, size_t size);
-
-static const struct afb_req_itf afb_hreq_itf = {
-	.json = (void*)req_json,
-	.get = (void*)req_get,
-	.success = (void*)req_success,
-	.fail = (void*)req_fail,
-	.raw = (void*)req_raw,
-	.send = (void*)req_send,
-	.context_get = (void*)afb_context_get,
-	.context_set = (void*)afb_context_set,
-	.addref = (void*)afb_hreq_addref,
-	.unref = (void*)afb_hreq_unref,
-	.session_close = (void*)afb_context_close,
-	.session_set_LOA = (void*)afb_context_change_loa
+static struct json_object *req_json(struct afb_xreq *xreq);
+static struct afb_arg req_get(struct afb_xreq *xreq, const char *name);
+static void req_reply(struct afb_xreq *xreq, struct json_object *object, const char *error, const char *info);
+static void req_destroy(struct afb_xreq *xreq);
+
+const struct afb_xreq_query_itf afb_hreq_xreq_query_itf = {
+	.json = req_json,
+	.get = req_get,
+	.reply = req_reply,
+	.unref = req_destroy
 };
 
 static struct hreq_data *get_data(struct afb_hreq *hreq, const char *key, int create)
@@ -165,7 +167,8 @@ static void afb_hreq_reply_v(struct afb_hreq *hreq, unsigned status, struct MHD_
 		MHD_add_response_header(response, k, v);
 		k = va_arg(args, const char *);
 	}
-	v = afb_context_sent_uuid(&hreq->context);
+
+	v = afb_context_uuid(&hreq->xreq.context);
 	if (v != NULL && asprintf(&cookie, cookie_setter, v) > 0) {
 		MHD_add_response_header(response, MHD_HTTP_HEADER_SET_COOKIE, cookie);
 		free(cookie);
@@ -175,10 +178,9 @@ static void afb_hreq_reply_v(struct afb_hreq *hreq, unsigned status, struct MHD_
 
 	hreq->replied = 1;
 	if (hreq->suspended != 0) {
-		extern void run_micro_httpd(struct afb_hsrv *hsrv);
 		MHD_resume_connection (hreq->connection);
 		hreq->suspended = 0;
-		run_micro_httpd(hreq->hsrv);
+		afb_hsrv_run(hreq->hsrv);
 	}
 }
 
@@ -267,21 +269,47 @@ static const char *mimetype_fd_name(int fd, const char *filename)
 	const char *result = NULL;
 
 #if defined(INFER_EXTENSION)
+	/*
+	 * Set some well-known extensions
+	 * Note that it is mandatory for example for css files in order to provide
+	 * right mimetype that must be text/css (otherwise chrome browser will not
+	 * load correctly css file) while libmagic returns text/plain.
+	 */
 	const char *extension = strrchr(filename, '.');
 	if (extension) {
 		static const char *const known[][2] = {
-			{ ".js",   "text/javascript" },
-			{ ".html", "text/html" },
-			{ ".css",  "text/css" },
-			{ NULL, NULL }
+			/* keep it sorted for dichotomic search */
+			{ ".css",	"text/css" },
+			{ ".gif",	"image/gif" },
+			{ ".html",	"text/html" },
+			{ ".htm",	"text/html" },
+			{ ".ico",	"image/x-icon"},
+			{ ".jpeg",	"image/jpeg" },
+			{ ".jpg",	"image/jpeg" },
+			{ ".js",	"text/javascript" },
+			{ ".json",	"application/json" },
+			{ ".mp3",	"audio/mpeg" },
+			{ ".png",	"image/png" },
+			{ ".svg",	"image/svg+xml" },
+			{ ".ttf",	"application/x-font-ttf"},
+			{ ".txt",	"text/plain" },
+			{ ".wav",	"audio/x-wav" },
+			{ ".xht",	"application/xhtml+xml" },
+			{ ".xhtml",	"application/xhtml+xml" },
+			{ ".xml",	"application/xml" }
 		};
-		int i = 0;
-		while (known[i][0]) {
-			if (!strcasecmp(extension, known[i][0])) {
+		int i, c, l = 0, u = sizeof known / sizeof *known;
+		while (l < u) {
+			i = (l + u) >> 1;
+			c = strcasecmp(extension, known[i][0]);
+			if (!c) {
 				result = known[i][1];
 				break;
 			}
-			i++;
+			if (c < 0)
+				u = i;
+			else
+				l = i + 1;
 		}
 	}
 #endif
@@ -292,20 +320,16 @@ static const char *mimetype_fd_name(int fd, const char *filename)
 	return result;
 }
 
-void afb_hreq_addref(struct afb_hreq *hreq)
-{
-	hreq->refcount++;
-}
-
-void afb_hreq_unref(struct afb_hreq *hreq)
+static void req_destroy(struct afb_xreq *xreq)
 {
+	struct afb_hreq *hreq = CONTAINER_OF_XREQ(struct afb_hreq, xreq);
 	struct hreq_data *data;
 
-	if (hreq == NULL || --hreq->refcount)
-		return;
-
 	if (hreq->postform != NULL)
 		MHD_destroy_post_processor(hreq->postform);
+	if (hreq->tokener != NULL)
+		json_tokener_free(hreq->tokener);
+
 	for (data = hreq->data; data; data = hreq->data) {
 		hreq->data = data->next;
 		if (data->path) {
@@ -316,11 +340,25 @@ void afb_hreq_unref(struct afb_hreq *hreq)
 		free(data->value);
 		free(data);
 	}
-	afb_context_disconnect(&hreq->context);
+	afb_context_disconnect(&hreq->xreq.context);
 	json_object_put(hreq->json);
+	free((char*)hreq->xreq.request.called_api);
+	free((char*)hreq->xreq.request.called_verb);
 	free(hreq);
 }
 
+void afb_hreq_addref(struct afb_hreq *hreq)
+{
+	afb_xreq_unhooked_addref(&hreq->xreq);
+}
+
+void afb_hreq_unref(struct afb_hreq *hreq)
+{
+	if (hreq->replied)
+		hreq->xreq.replied = 1;
+	afb_xreq_unhooked_unref(&hreq->xreq);
+}
+
 /*
  * Removes the 'prefix' of 'length' from the tail of 'hreq'
  * if and only if the prefix exists and is terminated by a leading
@@ -353,13 +391,29 @@ void afb_hreq_reply_error(struct afb_hreq *hreq, unsigned int status)
 	afb_hreq_reply_empty(hreq, status, NULL);
 }
 
+int afb_hreq_redirect_to_ending_slash_if_needed(struct afb_hreq *hreq)
+{
+	char *tourl;
+
+	if (hreq->url[hreq->lenurl - 1] == '/')
+		return 0;
+
+	/* the redirect is needed for reliability of relative path */
+	tourl = alloca(hreq->lenurl + 2);
+	memcpy(tourl, hreq->url, hreq->lenurl);
+	tourl[hreq->lenurl] = '/';
+	tourl[hreq->lenurl + 1] = 0;
+	afb_hreq_redirect_to(hreq, tourl, 1);
+	return 1;
+}
+
 int afb_hreq_reply_file_if_exist(struct afb_hreq *hreq, int dirfd, const char *filename)
 {
 	int rc;
 	int fd;
 	unsigned int status;
 	struct stat st;
-	char etag[1 + 2 * sizeof(int)];
+	char etag[1 + 2 * 8];
 	const char *inm;
 	struct MHD_Response *response;
 	const char *mimetype;
@@ -390,24 +444,17 @@ int afb_hreq_reply_file_if_exist(struct afb_hreq *hreq, int dirfd, const char *f
 
 	/* serve directory */
 	if (S_ISDIR(st.st_mode)) {
-		static const char *indexes[] = { "index.html", NULL };
-		int i = 0;
-		rc = 0;
-		while (indexes[i] != NULL) {
-			if (faccessat(fd, indexes[i], R_OK, 0) == 0) {
-				if (hreq->url[hreq->lenurl - 1] != '/') {
-					/* the redirect is needed for reliability of relative path */
-					char *tourl = alloca(hreq->lenurl + 2);
-					memcpy(tourl, hreq->url, hreq->lenurl);
-					tourl[hreq->lenurl] = '/';
-					tourl[hreq->lenurl + 1] = 0;
-					rc = afb_hreq_redirect_to(hreq, tourl);
-				} else {
+		rc = afb_hreq_redirect_to_ending_slash_if_needed(hreq);
+		if (rc == 0) {
+			static const char *indexes[] = { "index.html", NULL };
+			int i = 0;
+			while (indexes[i] != NULL) {
+				if (faccessat(fd, indexes[i], R_OK, 0) == 0) {
 					rc = afb_hreq_reply_file_if_exist(hreq, fd, indexes[i]);
+					break;
 				}
-				break;
+				i++;
 			}
-			i++;
 		}
 		close(fd);
 		return rc;
@@ -472,13 +519,209 @@ int afb_hreq_reply_file(struct afb_hreq *hreq, int dirfd, const char *filename)
 	return 1;
 }
 
-int afb_hreq_redirect_to(struct afb_hreq *hreq, const char *url)
+int afb_hreq_reply_locale_file_if_exist(struct afb_hreq *hreq, struct locale_search *search, const char *filename)
+{
+	int rc;
+	int fd;
+	unsigned int status;
+	struct stat st;
+	char etag[1 + 2 * 8];
+	const char *inm;
+	struct MHD_Response *response;
+	const char *mimetype;
+
+	/* Opens the file or directory */
+	fd = locale_search_open(search, filename[0] ? filename : ".", O_RDONLY);
+	if (fd < 0) {
+		if (errno == ENOENT)
+			return 0;
+		afb_hreq_reply_error(hreq, MHD_HTTP_FORBIDDEN);
+		return 1;
+	}
+
+	/* Retrieves file's status */
+	if (fstat(fd, &st) != 0) {
+		close(fd);
+		afb_hreq_reply_error(hreq, MHD_HTTP_INTERNAL_SERVER_ERROR);
+		return 1;
+	}
+
+	/* serve directory */
+	if (S_ISDIR(st.st_mode)) {
+		rc = afb_hreq_redirect_to_ending_slash_if_needed(hreq);
+		if (rc == 0) {
+			static const char *indexes[] = { "index.html", NULL };
+			int i = 0;
+			size_t length = strlen(filename);
+			char *extname = alloca(length + 30); /* 30 is enough to old data of indexes */
+			memcpy(extname, filename, length);
+			if (length && extname[length - 1] != '/')
+				extname[length++] = '/';
+			while (rc == 0 && indexes[i] != NULL) {
+				strcpy(extname + length, indexes[i++]);
+				rc = afb_hreq_reply_locale_file_if_exist(hreq, search, extname);
+			}
+		}
+		close(fd);
+		return rc;
+	}
+
+	/* Don't serve special files */
+	if (!S_ISREG(st.st_mode)) {
+		close(fd);
+		afb_hreq_reply_error(hreq, MHD_HTTP_FORBIDDEN);
+		return 1;
+	}
+
+	/* Check the method */
+	if ((hreq->method & (afb_method_get | afb_method_head)) == 0) {
+		close(fd);
+		afb_hreq_reply_error(hreq, MHD_HTTP_METHOD_NOT_ALLOWED);
+		return 1;
+	}
+
+	/* computes the etag */
+	sprintf(etag, "%08X%08X", ((int)(st.st_mtim.tv_sec) ^ (int)(st.st_mtim.tv_nsec)), (int)(st.st_size));
+
+	/* checks the etag */
+	inm = MHD_lookup_connection_value(hreq->connection, MHD_HEADER_KIND, MHD_HTTP_HEADER_IF_NONE_MATCH);
+	if (inm && 0 == strcmp(inm, etag)) {
+		/* etag ok, return NOT MODIFIED */
+		close(fd);
+		DEBUG("Not Modified: [%s]", filename);
+		response = MHD_create_response_from_buffer(0, empty_string, MHD_RESPMEM_PERSISTENT);
+		status = MHD_HTTP_NOT_MODIFIED;
+	} else {
+		/* check the size */
+		if (st.st_size != (off_t) (size_t) st.st_size) {
+			close(fd);
+			afb_hreq_reply_error(hreq, MHD_HTTP_INTERNAL_SERVER_ERROR);
+			return 1;
+		}
+
+		/* create the response */
+		response = MHD_create_response_from_fd((size_t) st.st_size, fd);
+		status = MHD_HTTP_OK;
+
+		/* set the type */
+		mimetype = mimetype_fd_name(fd, filename);
+		if (mimetype != NULL)
+			MHD_add_response_header(response, MHD_HTTP_HEADER_CONTENT_TYPE, mimetype);
+	}
+
+	/* fills the value and send */
+	afb_hreq_reply(hreq, status, response,
+			MHD_HTTP_HEADER_CACHE_CONTROL, hreq->cacheTimeout,
+			MHD_HTTP_HEADER_ETAG, etag,
+			NULL);
+	return 1;
+}
+
+int afb_hreq_reply_locale_file(struct afb_hreq *hreq, struct locale_search *search, const char *filename)
+{
+	int rc = afb_hreq_reply_locale_file_if_exist(hreq, search, filename);
+	if (rc == 0)
+		afb_hreq_reply_error(hreq, MHD_HTTP_NOT_FOUND);
+	return 1;
+}
+
+struct _mkq_ {
+	int count;
+	size_t length;
+	size_t alloc;
+	char *text;
+};
+
+static void _mkq_add_(struct _mkq_ *mkq, char value)
+{
+	char *text = mkq->text;
+	if (text != NULL) {
+		if (mkq->length == mkq->alloc) {
+			mkq->alloc += 100;
+			text = realloc(text, mkq->alloc);
+			if (text == NULL) {
+				free(mkq->text);
+				mkq->text = NULL;
+				return;
+			}
+			mkq->text = text;
+		}
+		text[mkq->length++] = value;
+	}
+}
+
+static void _mkq_add_hex_(struct _mkq_ *mkq, char value)
+{
+	_mkq_add_(mkq, (char)(value < 10 ? value + '0' : value + 'A' - 10));
+}
+
+static void _mkq_add_esc_(struct _mkq_ *mkq, char value)
+{
+	_mkq_add_(mkq, '%');
+	_mkq_add_hex_(mkq, (char)((value >> 4) & 15));
+	_mkq_add_hex_(mkq, (char)(value & 15));
+}
+
+static void _mkq_add_char_(struct _mkq_ *mkq, char value)
+{
+	if (value <= ' ' || value >= 127)
+		_mkq_add_esc_(mkq, value);
+	else
+		switch(value) {
+		case '=':
+		case '&':
+		case '%':
+			_mkq_add_esc_(mkq, value);
+			break;
+		default:
+			_mkq_add_(mkq, value);
+		}
+}
+
+static void _mkq_append_(struct _mkq_ *mkq, const char *value)
+{
+	while(*value)
+		_mkq_add_char_(mkq, *value++);
+}
+
+static int _mkquery_(struct _mkq_ *mkq, enum MHD_ValueKind kind, const char *key, const char *value)
+{
+	_mkq_add_(mkq, mkq->count++ ? '&' : '?');
+	_mkq_append_(mkq, key);
+	if (value != NULL) {
+		_mkq_add_(mkq, '=');
+		_mkq_append_(mkq, value);
+	}
+	return 1;
+}
+
+static char *url_with_query(struct afb_hreq *hreq, const char *url)
 {
-	/* TODO: append the query part! */
+	struct _mkq_ mkq;
+
+	mkq.count = 0;
+	mkq.length = strlen(url);
+	mkq.alloc = mkq.length + 1000;
+	mkq.text = malloc(mkq.alloc);
+	if (mkq.text != NULL) {
+		strcpy(mkq.text, url);
+		MHD_get_connection_values(hreq->connection, MHD_GET_ARGUMENT_KIND, (void*)_mkquery_, &mkq);
+		_mkq_add_(&mkq, 0);
+	}
+	return mkq.text;
+}
+
+void afb_hreq_redirect_to(struct afb_hreq *hreq, const char *url, int add_query_part)
+{
+	const char *to;
+	char *wqp;
+
+	wqp = add_query_part ? url_with_query(hreq, url) : NULL;
+	to = wqp ? : url;
 	afb_hreq_reply_static(hreq, MHD_HTTP_MOVED_PERMANENTLY, 0, NULL,
-			MHD_HTTP_HEADER_LOCATION, url, NULL);
+			MHD_HTTP_HEADER_LOCATION, to, NULL);
 	DEBUG("redirect from [%s] to [%s]", hreq->url, url);
-	return 1;
+	free(wqp);
 }
 
 const char *afb_hreq_get_cookie(struct afb_hreq *hreq, const char *name)
@@ -497,6 +740,23 @@ const char *afb_hreq_get_header(struct afb_hreq *hreq, const char *name)
 	return MHD_lookup_connection_value(hreq->connection, MHD_HEADER_KIND, name);
 }
 
+const char *afb_hreq_get_authorization_bearer(struct afb_hreq *hreq)
+{
+	const char *value = afb_hreq_get_header(hreq, MHD_HTTP_HEADER_AUTHORIZATION);
+	if (value) {
+		if (strncasecmp(value, key_for_bearer, sizeof key_for_bearer - 1) == 0) {
+			value += sizeof key_for_bearer - 1;
+			if (isblank(*value++)) {
+				while (isblank(*value))
+					value++;
+				if (*value)
+					return value;
+			}
+		}
+	}
+	return NULL;
+}
+
 int afb_hreq_post_add(struct afb_hreq *hreq, const char *key, const char *data, size_t size)
 {
 	void *p;
@@ -604,14 +864,10 @@ int afb_hreq_post_add_file(struct afb_hreq *hreq, const char *key, const char *f
 	return !size;
 }
 
-struct afb_req afb_hreq_to_req(struct afb_hreq *hreq)
-{
-	return (struct afb_req){ .itf = &afb_hreq_itf, .closure = hreq };
-}
-
-static struct afb_arg req_get(struct afb_hreq *hreq, const char *name)
+static struct afb_arg req_get(struct afb_xreq *xreq, const char *name)
 {
 	const char *value;
+	struct afb_hreq *hreq = CONTAINER_OF_XREQ(struct afb_hreq, xreq);
 	struct hreq_data *hdat = get_data(hreq, name, 0);
 	if (hdat)
 		return (struct afb_arg){
@@ -634,10 +890,11 @@ static int _iterargs_(struct json_object *obj, enum MHD_ValueKind kind, const ch
 	return 1;
 }
 
-static struct json_object *req_json(struct afb_hreq *hreq)
+static struct json_object *req_json(struct afb_xreq *xreq)
 {
 	struct hreq_data *hdat;
 	struct json_object *obj, *val;
+	struct afb_hreq *hreq = CONTAINER_OF_XREQ(struct afb_hreq, xreq);
 
 	obj = hreq->json;
 	if (obj == NULL) {
@@ -663,78 +920,102 @@ static struct json_object *req_json(struct afb_hreq *hreq)
 	return obj;
 }
 
-static const char *req_raw(struct afb_hreq *hreq, size_t *size)
+static inline const char *get_json_string(json_object *obj)
 {
-	const char *result = json_object_get_string(req_json(hreq));
-	*size = result ? strlen(result) : 0;
-	return result;
+	return json_object_to_json_string_ext(obj, JSON_C_TO_STRING_PLAIN|JSON_C_TO_STRING_NOSLASHESCAPE);
 }
-
-static void req_send(struct afb_hreq *hreq, const char *buffer, size_t size)
-{
-	afb_hreq_reply_copy(hreq, MHD_HTTP_OK, size, buffer, NULL);
-}
-
 static ssize_t send_json_cb(json_object *obj, uint64_t pos, char *buf, size_t max)
 {
-	ssize_t len = stpncpy(buf, json_object_to_json_string(obj)+pos, max) - buf;
+	ssize_t len = stpncpy(buf, get_json_string(obj)+pos, max) - buf;
 	return len ? : (ssize_t)MHD_CONTENT_READER_END_OF_STREAM;
 }
 
-static void req_reply(struct afb_hreq *hreq, unsigned retcode, const char *status, const char *info, json_object *resp)
+static void req_reply(struct afb_xreq *xreq, struct json_object *object, const char *error, const char *info)
 {
-	struct json_object *reply, *request;
-	const char *token, *uuid, *reqid;
+	struct afb_hreq *hreq = CONTAINER_OF_XREQ(struct afb_hreq, xreq);
+	struct json_object *sub, *reply;
+	const char *reqid;
 	struct MHD_Response *response;
 
-	token = afb_context_sent_token(&hreq->context);
-	uuid = afb_context_sent_uuid(&hreq->context);
-
-	reply = afb_msg_json_reply(status, info, resp, token, uuid);
+	/* create the reply */
+	reply = afb_msg_json_reply(object, error, info, &xreq->context);
 
+	/* append the req id on need */
 	reqid = afb_hreq_get_argument(hreq, long_key_for_reqid);
 	if (reqid == NULL)
 		reqid = afb_hreq_get_argument(hreq, short_key_for_reqid);
-	if (reqid != NULL && json_object_object_get_ex(reply, "request", &request))
-		json_object_object_add (request, short_key_for_reqid, json_object_new_string(reqid));
-
-	response = MHD_create_response_from_callback((uint64_t)strlen(json_object_to_json_string(reply)), SIZE_RESPONSE_BUFFER, (void*)send_json_cb, reply, (void*)json_object_put);
-	afb_hreq_reply(hreq, retcode, response, NULL);
-}
-
-static void req_fail(struct afb_hreq *hreq, const char *status, const char *info)
-{
-	req_reply(hreq, MHD_HTTP_OK, status, info, NULL);
+	if (reqid != NULL && json_object_object_get_ex(reply, "request", &sub))
+		json_object_object_add(sub, "reqid", json_object_new_string(reqid));
+
+	response = MHD_create_response_from_callback(
+			(uint64_t)strlen(get_json_string(reply)),
+			SIZE_RESPONSE_BUFFER,
+			(void*)send_json_cb,
+			reply,
+			(void*)json_object_put);
+
+	/* handle authorisation feedback */
+	if (error == afb_error_text_invalid_token)
+		afb_hreq_reply(hreq, MHD_HTTP_UNAUTHORIZED, response, MHD_HTTP_HEADER_WWW_AUTHENTICATE, "error=\"invalid_token\"", NULL);
+	else if (error == afb_error_text_insufficient_scope)
+		afb_hreq_reply(hreq, MHD_HTTP_FORBIDDEN, response, MHD_HTTP_HEADER_WWW_AUTHENTICATE, "error=\"insufficient_scope\"", NULL);
+	else
+		afb_hreq_reply(hreq, MHD_HTTP_OK, response, NULL);
 }
 
-static void req_success(struct afb_hreq *hreq, json_object *obj, const char *info)
+void afb_hreq_call(struct afb_hreq *hreq, struct afb_apiset *apiset, const char *api, size_t lenapi, const char *verb, size_t lenverb)
 {
-	req_reply(hreq, MHD_HTTP_OK, "success", info, obj);
+	hreq->xreq.request.called_api = strndup(api, lenapi);
+	hreq->xreq.request.called_verb = strndup(verb, lenverb);
+	if (hreq->xreq.request.called_api == NULL || hreq->xreq.request.called_verb == NULL) {
+		ERROR("Out of memory");
+		afb_hreq_reply_error(hreq, MHD_HTTP_INTERNAL_SERVER_ERROR);
+	} else if (afb_hreq_init_context(hreq) < 0) {
+		afb_hreq_reply_error(hreq, MHD_HTTP_INTERNAL_SERVER_ERROR);
+	} else {
+		afb_xreq_unhooked_addref(&hreq->xreq);
+		afb_xreq_process(&hreq->xreq, apiset);
+	}
 }
 
 int afb_hreq_init_context(struct afb_hreq *hreq)
 {
 	const char *uuid;
 	const char *token;
+	struct afb_token *tok;
 
-	if (hreq->context.session != NULL)
+	if (hreq->xreq.context.session != NULL)
 		return 0;
 
+	/* get the uuid of the session */
 	uuid = afb_hreq_get_header(hreq, long_key_for_uuid);
-	if (uuid == NULL)
+	if (uuid == NULL) {
 		uuid = afb_hreq_get_argument(hreq, long_key_for_uuid);
-	if (uuid == NULL)
-		uuid = afb_hreq_get_cookie(hreq, cookie_name);
-	if (uuid == NULL)
-		uuid = afb_hreq_get_argument(hreq, short_key_for_uuid);
+		if (uuid == NULL) {
+			uuid = afb_hreq_get_cookie(hreq, cookie_name);
+			if (uuid == NULL)
+				uuid = afb_hreq_get_argument(hreq, short_key_for_uuid);
+		}
+	}
 
-	token = afb_hreq_get_header(hreq, long_key_for_token);
-	if (token == NULL)
-		token = afb_hreq_get_argument(hreq, long_key_for_token);
-	if (token == NULL)
-		token = afb_hreq_get_argument(hreq, short_key_for_token);
+	/* get the authorisation token */
+	token = afb_hreq_get_authorization_bearer(hreq);
+	if (token == NULL) {
+		token = afb_hreq_get_argument(hreq, key_for_access_token);
+		if (token == NULL) {
+			token = afb_hreq_get_header(hreq, long_key_for_token);
+			if (token == NULL) {
+				token = afb_hreq_get_argument(hreq, long_key_for_token);
+				if (token == NULL)
+					token = afb_hreq_get_argument(hreq, short_key_for_token);
+			}
+		}
+	}
+	tok = NULL;
+	if (token)
+		afb_token_get(&tok, token);
 
-	return afb_context_connect(&hreq->context, uuid, token);
+	return afb_context_connect(&hreq->xreq.context, uuid, tok, NULL);
 }
 
 int afb_hreq_init_cookie(int port, const char *path, int maxage)
@@ -757,4 +1038,19 @@ int afb_hreq_init_cookie(int port, const char *path, int maxage)
 	return 1;
 }
 
+struct afb_xreq *afb_hreq_to_xreq(struct afb_hreq *hreq)
+{
+	return &hreq->xreq;
+}
+
+struct afb_hreq *afb_hreq_create()
+{
+	struct afb_hreq *hreq = calloc(1, sizeof *hreq);
+	if (hreq) {
+		/* init the request */
+		afb_xreq_init(&hreq->xreq, &afb_hreq_xreq_query_itf);
+		hreq->reqid = ++global_reqids;
+	}
+	return hreq;
+}