Revert "228 is_hidden"

This reverts commit 3c4fdf77fd.

v1/Application.cfc

@@ -57,7 +57,7 @@
 		
 		//variables.framework.docs={};
 		variables.framework.docs.APIName="svc-api";
-		variables.framework.docs.APIVersion="0.228";   /*$ git config --global --unset user.password*/
+		variables.framework.docs.APIVersion="0.227";   /*$ git config --global --unset user.password*/
 		
 		variables.framework.globalHeaders = structNew();
 		variables.framework.globalHeaders["Access-Control-Expose-Headers"] = "Location"; 
@@ -336,14 +336,48 @@
 	
 		return true;
 		
-	
 		
+////////////////////////////////////////////////////////////////////////////
+		//ensure https because of basic authentication 
+		if (!lcase(request.config.environment) == "development"){
+			if (!cgi.server_port_secure) { return newRepresentation().noData().withStatus("403.4", "SSL Required");}
+		}
+		
+		request.usr_id=request.UNDEFINED_USR_ID;
+		
+		if (checkAuth()) {return true;}
+		
+		//return 	representationOf(arguments.headers);
+		//return 	representationOf(arguments.cfc);
+		var authToken="";
+		if (structKeyExists(arguments.headers,"x-auth-token")) {authToken=structFind(arguments.headers,"x-auth-token");}
+		var issuedFor="";
+		if (structKeyExists(arguments.headers,"x-issued-for")) {issuedFor=structFind(arguments.headers,"x-issued-for");}
+		if (validatePin(authToken,issuedFor, arguments.verb, arguments.cfc)) return true; //side effect: sets request.usr_id!		
+		
+		if (!validateCredentials(getBasicAuthCredentials())) {
+			return newRepresentation().noData().withStatus("401", "Invalid Credentials").withHeaders({"WWW-Authenticate":"Basic realm=mms-api"});
+		}
+		return true;
 	}
 
+	//private function validateToken(token){ return false; }
 	
+	//refactoring required
+	private function validateCredentials(credentials) {//return true;		
+		if (arguments.credentials.username == "medved" /*AND credentials.password == "ghtdtlrhjcfdxtu!Y"*/) {
+			request.usr_id=-3;
+			return true; 
+		}
+		return false;
+	}
 	
 	</cfscript>
-
+	
+<!---	стоит ли сообщать отдельно об экспирации пина
+	нужно блокировать перебор, можно делать пару pin-issuedFor
+	вероятно, лучше сделать токен девайса
+	--->