Support Oauth 2.0 client credentials grant flow about gbfs-validator

[PierrickP]

Hello @testower
This is probably a nice update !

Can you make a PR ?
Are you a GBFS producer or consumer ? I'm not sure to have this kind on feed to correctly test it.

For the update, i would see a new option on auth select on website with 3 inputs (username / password / endpoint ?)
Then something here

gbfs-validator/gbfs-validator/gbfs.js

Lines 61 to 81 in 596378a

	this.auth = auth
	this.gotOptions = {}
	if (this.auth && this.auth.type) {
	if (this.auth.type === 'basic_auth' && this.auth.basicAuth) {
	this.gotOptions.headers = {
	Authorization: `basic ${Buffer.from(
	`${this.auth.basicAuth.user}:${this.auth.basicAuth.password}`,
	'utf-8'
	).toString('base64')}`
	}
	}
	if (this.auth.type === 'bearer_token' && this.auth.bearerToken) {
	this.gotOptions.headers = {
	Authorization: `Bearer ${this.auth.bearerToken.token}`
	}
	}
	}
	}

to get the access token

[testower]

From the point of view of this request I'm a consumer. Yes I'd be happy to make a PR on this.

Yes I think 3 options as you mention makes sense.

However, retrieving the access token in the constructor is a tricky affair since it needs to be an async operation, and constructors can't be async (?). So I think it maybe be better to do it lazily on the first actual request and then save the token for the subsequent requests.

Let me know if that makes sense.

[testower]

I need to correct myself: While it is technically possible to make the constructor async / return a promise, it is a bit unorthodox and would possibly feel strange in this case, unless you actually need to use this particular feature.

[PierrickP]

Hello, sorry for the late reply.
I agree for the async constructor, it's a bad idea.
At first, i thinking of making the auth roundtrip on the frontend and return the access token to the back.
Or you can add an async function on the validation function https://github.com/MobilityData/gbfs-validator/blob/master/gbfs-validator/gbfs.js#L262 . Others functions are not write to be called outside of the class.

[testower]

Yeah I think on the validation function is the better option. I'll have a PR ready today hopefully 👍