/**
 * 
 */
package controllers;

import models.User;
import play.libs.Json;
import play.mvc.Result;

/**
 * 
 * This Controller provide a simple 200/401 API for requests that are used to
 * probe what roles the current user has access to. It is intended to be used
 * with NGINX http_auth_request.
 * 
 * @author Andrew Jackson <Andrew.Jackson@bl.uk>
 *
 */
public class APISecurityCheckController extends AbstractController {

    public static Result isUser() {
        // Get the email from the session:
        String email = session().get("email");
        if (email == null) {
            return unauthorized("unauthorized - you must be logged in!");
        }
        // Otherwise, all good:
        return ok(Json.toJson("isUser"));
    }

    public static Result isLDLMember() {
        // Get the email from the session:
        String email = session().get("email");
        if (email == null) {
            return unauthorized("unauthorized - you must be logged in!");
        }

        // Load the user and check rights:
        User user = User.findByEmail(email);
        if (!user.isLDLMember()) {
            return unauthorized(
                    "unauthorized - you must be a member of a Legal Deposit library organisation to view the crawled resources");
        }

        // Otherwise, all good:
        return ok(Json.toJson("isLDLMember"));
    }

}

@@ -685,32 +685,312 @@
 wise, all good:%0A
+        User user = User.findByEmail(email);%0A        response().setHeader(%22X-Auth-Remote-User%22, user.name);%0A        response().setHeader(%22X-Auth-Remote-User-Email%22, user.email);%0A        response().setHeader(%22X-Auth-Remote-User-Primary-Role%22,%0A                user.getRole().name);%0A
         return o
@@ -1588,32 +1588,267 @@
 wise, all good:%0A
+        response().setHeader(%22X-Auth-Remote-User%22, user.name);%0A        response().setHeader(%22X-Auth-Remote-User-Email%22, user.email);%0A        response().setHeader(%22X-Auth-Remote-User-Primary-Role%22,%0A                user.getRole().name);%0A
         return o

Add name/role/etc. to auth endpoint.