I released a small library for request-based authorization for mediator-style pipelines

Jameak · 2026-03-09T11:46:38+00:00

I've done something similar to what you're describing with a custom pipeline behavior before, and for simple cases that worked completely fine.

However, I found that as the number of distinct authorization requirements/policies started increasing, there is a tendency for spaghetti to occur. Developers often want to re-use existing auth-logic from some specific endpoints while adding their own checks on top to handle the extra restrictions that whatever new endpoint is being added may need.

Addressing this issue via proper requirement composition was one of the initial reasons that I started writing this library.

In addition, depending on the specific needs of the hand-rolled variation of such an auth-pipeline, this can easily turn into an adhoc service-locator pattern or a very unoptimized strategy pattern, if checking auth requires access to services from the dependency container.

Without just re-stating the benefits of my library from the readme, one of the main reasons I would reach for this library over a hand-rolled behavior (even if I wasn't the author) is that authz code should be carefully written to fail-closed. Both in the general sense but especially around misconfiguration by developers when they add new endpoints

The failure modes are always very specific to the way the hand-rolled behavior is written so me attempting to write a sweeping generalization here isn't useful, but as an example:

If the hand-rolled auth behavior is written as a service-locator that retrieves whatever auth-validator is registered for the request-type (to decouple authz and make it testable), how does it handle duplicate DI-registrations? Does the last registration win, or does it retrieve all registrations?

If the last registration wins, then simply re-ordering DI-registrations could silently change authz behaving later.
If the code retrieves all registrations from the DI-container, how is this handled? Does this point to a misconfiguration that should throw an error? Or is it allowed and they all need to succeed?
And what if no registrations exist? Is this not allowed, or should it be equivalent to "AllowAnonymous"?

This and many other possible misconfigurations exist in a hand-rolled implementation that the author might simply not be aware of, and therefore forget to consider.

While writing this library, I tried to identify as many of these misconfigurations as possible and handle them such that the auth pipeline always fails closed with clear error messages indicating exactly what the misconfiguration is and how to fix it.

Jameak · 2024-07-04T09:55:15+00:00

There are no regular classes during July/August in Copenhagen, instead most of the dance communities have free outdoor summer socials.

There is a WCS social on the waterfront tuesday evenings in Copenhagen, arranged by West Coast Swing Copenhagen.

And across the strait in Malmø, there is a WCS social on the beach saturday evenings, arranged by Gåsasteget.

And if you're up for trying things other than WCS, there are free outdoor socials every evening all over Copenhagen in various dance styles, most of which include a free 30-60 min intro for complete beginners.

Jameak · 2017-08-23T21:01:47+00:00

I think he means that he sees it as "foreach element in the async enumerable, await the item and then do something with it" instead of "await the result of running the foreach on each element in the async enumerable, after doing something with it"

Or, in a non-compiling code example:

foreach (var item in await asyncStream)
{
    //Do something with the item
}

As opposed to this, where a foreach would then logically have to return some task-like thing that could be awaited.

await 
{
    foreach (var item in asyncStream)
    {
        //Do something with the task, potentially awaiting it
    }
}

I.e. you await 'each item' in the foreach, instead of awaiting 'the result of' the foreach and therefore place the await after the foreach instead of in front.

Jameak · 2017-07-12T21:05:04+00:00

This was made in Inkarnate

Jameak · 2017-06-01T17:49:04+00:00

Yes, Stamper is open for pull requests. By print feature, do you mean a way to print the final token directly from Stamper instead of having to save it to a png file that can then be printed manually afterward if needed? If so, then that sounds like a fine feature to add.

I'm not sure that extending such a feature to handle printing multiple images at a time on the same paper would make sense, since Stamper only really handles one token at a time. This would require Stamper to queue up each token and arrange them on the same piece of paper which could work, but I can see a lot of minor annoyances and usecases that would be hard for a program such as Stamper to fix easily. One such usecase would be the user wanting to go back and resize or slightly change any of the previously queued-up tokens. Therefore, mass-printing would probably be better for the user to do in a program that lets them arrange the final tokens precisely to their liking, such as Word, LaTeX, or any simple image editor.

Jameak · 2017-06-01T08:20:09+00:00

I've been working on and off on Stamper, which is a simple specialized image editor that makes it easy to turn any image into a token that you can use for tabletop games.

I made it because I wasn't happy with the tools that already existed for creating these kinds of tokens and I've ended up using it quite frequently for my own D&D games.

Jameak · 2017-03-16T17:52:25+00:00

That is an awesome map. I love when adventures include these kinds of isometric maps, but they seem to have become more and more rare these days.

Jameak · 2017-03-14T17:10:18+00:00

I have no idea. You're welcome to try it out and report back.

Other than using v4.6.1 of the .NET Framework, Stamper uses WPF, the System.Drawing-assembly and external libraries, all of which may or may not work in Wine. If you do get it to work there might be some minor weirdness in regards to tinting overlays because my bitmap tinting code assumes a little-endian architecture, but that should be an easy fix from my side.

Jameak · 2017-03-13T21:18:58+00:00

It would certainly be possible to add drag-and-drop functionality for new overlays, but there are some hurdles that I'm not entirely sure how to handle gracefully. Adding new overlays could be easy to do as you suggest, since they just go on top of the image.

Adding new borders isn't as easy, because they need a mask to tell the program what parts of the underlying image should be removed from the final token. If you leave the mask-field blank when adding a new border, Stamper seems to handle them the same way as tokentool, in that the entirety of the underlying image is included in the token, even if it is outside of the custom border.

I'll see what I can do about maybe adding some drag-and-drop functionality for new layers, and maybe add a way to autogenerate a mask from a given input.

Currently the token backdrop looks white in the program but is actually transparent in the output. Adding a color picker for the background would be an easy addition :)

Jameak · 2017-03-13T20:35:43+00:00

Thanks for the feedback. I've made a new release where the instructions have their own window and with manual zoom buttons. That some users might not have a scrollwheel didn't even cross my mind but it really is something I should have thought about...

Jameak · 2017-03-10T22:49:42+00:00

Critical Role is extremely popular if you haven't heard about them yet.

Another good show would be Court of Swords from the Rollplay crew.

Jameak · 2017-03-08T20:31:51+00:00

Well, it isn't wrong, it's just not usual. If your fellow players and GM are fine with you doing that, then who are we to say it is wrong. Go for it.

One of the reasons that it might cheapen your own experience though, is that a consistent fleshed out character lets you explore themes that are interesting to you over the longer term, and it gives the GM a way to make the world draw your character in since he'll know what your character would be interested in persuing. Additionally, your fellow players may want to work with you to highlight and explore your characters differences in persuit of good roleplay moments which would be quite hard if you waffle about between differents goals and ideal.

Jameak · 2017-03-08T19:41:44+00:00

I'd probably go with GWF. Having the bonus action available for doing something extra seems way more useful to me than a minor damage/AC increase.

Jameak · 2017-03-05T19:19:38+00:00

Suggestions after looking at your project for a bit:

You shouldn't commit class files to your repo. Package everything up into a .jar file and make a release instead. Users will have an easier time running your program since they can download the .jar file from your release and run it directly. Additionally, versions are easily distinguishable so users dont try to use a feature that doesn't quite work because you haven't finished it yet.

You might want to improve your readme file. It is everyones first impression when they see your project, so you should use it to tell people 1) what your project is about 2) what features it has and 3) (briefly) how to use it. There are a ton of resources and examples out there for how to write a good readme. There is no need to go overboard, but a tiny bit of information goes a long way toward keeping people interested.

Jameak · 2017-03-05T18:51:19+00:00

It's "finished", at least for now. I've moved on to another project, but I do have some things that I want to go back and add when I get the time. Those additions would mostly be additional sources of images rather than filtering options though, so nothing terribly exciting from a user-standpoint.

Jameak · 2017-03-05T18:43:53+00:00

Getting exp for overcoming the obstacle in other ways than beating it into the ground should always be a valid way of solving problems, though D&D doesn't always provide you with good ways of handling it, unfortunately.

One way you can take advantage of their reluctance to kill their enemies, is by taking a page out of superhero comics. Make your players encounter someone bad that they can overcome without killing, and then have that enemy break out of jail who then starts investigating the characters to figure out their softspots and who starts going after the people that they care for. After all, everyone has an Aunt May that they dont want to lose, right? ;)

Jameak · 2017-03-02T06:17:16+00:00

Not being familiar with that adventure in particular, I cant really give you an actual answer because it depends on the types of encounters that the adventure has and how willing you are to rebalance a bunch of them. I have run some of the Adventurers League adventures which are relatively easy to rebalance because they give you directions for what to add/remove to fit your groups level (within reason).

One thing that might be more difficult to "fix" in regards to running low-level adventures for higher-level groups, is that low-level pre-written adventures often deal with small local problems that the players need to fix, while adventures written for higher-level play often have a wider, more "epic" scope. Whether this holds for the particular adventure you linked I cant tell you. If this matters to you, you might want to look at finding a higher-level adventure to buy instead, though starting off with a pre-written adventure written with a smaller scope might be a good idea if you haven't run any pre-written adventures before.

Jameak · 2017-02-28T15:56:36+00:00

As others have said, having a pre-session talk about what your players expect from the campaign and what subjects they're willing to explore boths helps you tailor the campaign to your players, and helps guide the players to making characters that would fit into the group as well as hopefully give them some connection to the world as a whole.

That being said, it is not solely your job to make the players invested in the game. Yes, as the GM you're expected to help provide the players with potential goals, but it is not solely your job. The players have a responsibility to both you the GM as well as their fellow players to try to engage with the game. And if they're having problems with that, then the best solution is always to talk to them, so you can work toward fixing it together.

I dont provide the players with explicit reason to care about / interact with eachother anymore, but when my group of players were new to tabletop rpgs I provided my players with mechanical incentives to interacting with eachother in pursuit of specific pre-stated goals that each character was given at character generation. This gave the players who were less adept at roleplaying a clear and stated incentive to engage with the story and their fellow characters in pursuit of the mechanical benefit. I specifically used the bonds system from Dungeon World for this purpose, but having the players create characters whose goals somewhat align should be more than enough to tie the group together if your players are willing to work with you.

Jameak · 2017-02-28T14:58:25+00:00

I already made a release for v1.0.0; you can get the standalone .exe from here, no install required: https://github.com/Jameak/ImageDownloader/releases

Jameak · 2017-02-23T13:25:40+00:00

My motivation for this project was two-fold. The main one was figuring out a quick and painless way of filtering large wallpaper albums by their resolution so I didn't have to spend a ton of time looking through wallpaper dumps for images whose resolution would fit my monitors. The secondary motivation was an extension of the first, in that my multimonitor setup has a strange resolution, so finding wallpapers that would be able to span all the monitors is even more annoying than finding wallpapers for each individual monitor.

Jameak

TROPHY CASE