* some stuff moved to UtilityModule(old DoctrineExpressiveModule)

* api auth in place

config/autoload/auth.global.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+  'acl_config' => [
+    'unguarded_routes' => [
+      'api.auth.login',
+      'api.ping',
+    ],
+  ],
+];

config/autoload/dependencies.global.php

@@ -21,7 +21,6 @@ return [
         // Use 'factories' for services provided by callbacks/factory classes.
         'factories'  => [
             // Fully\Qualified\ClassName::class => Fully\Qualified\FactoryName::class,
-            Tuupola\Middleware\CorsMiddleware::class => DoctrineExpressiveModule\Middleware\CorsMiddlewareFactory::class,
         ],
     ],
 ];

config/autoload/local.php.dist

@@ -9,4 +9,7 @@
 declare(strict_types=1);
 
 return [
+    'acl_config' => [
+        'hmac_key' => '',
+    ],
 ];

config/config.php

@@ -26,7 +26,7 @@ $aggregator = new ConfigAggregator([
     \Zend\Expressive\Router\ConfigProvider::class,
 
     // Default App module config
-    DoctrineExpressiveModule\ConfigProvider::class,
+    UtilityModule\ConfigProvider::class,
     App\ConfigProvider::class,
 
     // Load application config in a pre-defined order in such a way that local settings

config/pipeline.php

@@ -11,7 +11,6 @@ use Zend\Expressive\Helper\UrlHelperMiddleware;
 use Zend\Expressive\MiddlewareFactory;
 use Zend\Expressive\Router\Middleware\DispatchMiddleware;
 use Zend\Expressive\Router\Middleware\ImplicitHeadMiddleware;
-use Zend\Expressive\Router\Middleware\ImplicitOptionsMiddleware;
 use Zend\Expressive\Router\Middleware\MethodNotAllowedMiddleware;
 use Zend\Expressive\Router\Middleware\RouteMiddleware;
 use Zend\Stratigility\Middleware\ErrorHandler;
@@ -54,7 +53,6 @@ return function (Application $app, MiddlewareFactory $factory, ContainerInterfac
     // Order here matters; the MethodNotAllowedMiddleware should be placed
     // after the Implicit*Middleware.
     $app->pipe(ImplicitHeadMiddleware::class);
-//    $app->pipe(ImplicitOptionsMiddleware::class);
     $app->pipe(CorsMiddleware::class);
     $app->pipe(MethodNotAllowedMiddleware::class);
 
@@ -67,6 +65,7 @@ return function (Application $app, MiddlewareFactory $factory, ContainerInterfac
     // - route-based authentication
     // - route-based validation
     // - etc.
+    $app->pipe(Tuupola\Middleware\JwtAuthentication::class);
 
     // Register the dispatch middleware in the middleware pipeline
     $app->pipe(DispatchMiddleware::class);

config/routes.php

@@ -61,4 +61,7 @@ return function (Application $app, MiddlewareFactory $factory, ContainerInterfac
     $app->get('/awards', App\Handler\AwardeeRedirectHandler::class, 'awardees');
     $app->get('/awards/{year:\d+}', App\Handler\AwardeeHandler::class, 'awardees-by-year');
     $app->get('/awardee/{slug}', App\Handler\ProfileHandler::class, 'awardee');
+
+    $app->post('/api/auth/login', UtilityModule\Handler\AuthHandler::class, 'api.auth.login');
+    $app->get('/api/auth/renew', UtilityModule\Handler\AuthHandler::class, 'api.auth.renew');
 };