http with authentication for module

[vincentvdk]

Hi,

Are there some smart ways to keep a module "protected" using an http url with authentication?

[holzensp]

There currently isn't, I'm afraid. Would you really want that for the module level (as opposed to the package level)? There is some subtle interaction with caching here; Pkl only caches packages, not modules loaded through https. There are also quite a few different scenarios for where the credentials should live. If not hard-coded in the URL, import is tricky. import needs its argument to be a string literal; it won't accept interpolated strings, so you can't read("prop:token") or so. Could you add some detail on what your scenario is?

[vincentvdk]

Hi, apologies for the late reply. package would be fine. Our use-case is that we want to provide a pkl package/module to developer teams which will allow them to configure "infrastructure" resources. Although there is currently no real sensitive date in those, we operate in a rather public and visible environment and try to keep things as private as possible

[holzensp]

Would the work on HTTP proxying be helpful here?

[vincentvdk]

Do you mean this #309 . A proxy might be a possible solution indeed

[bmurray]

We have a bunch of pkl schemas hosted on GitHub private repos. It's a great way to share them but there was no easy way to deal with this. I created a pkl-proxy that handles this. Effectively it uses the http-rewrite functionality to force requests to a private repo to go through the proxy that handles that complex auth flow.

If you have a private but accessible http server you can just point it at that. Take a look at what I did and maybe it can be adapted.

https://github.com/bmurray/pkl-proxy