TSQLAuthUser and/or TSQLAuthGroup classes to store the authorization
      information: TSQLRestServer will search for any table inheriting from
      TSQLAuthUser/TSQLAuthGroup in the TSQLModel - see also corresponding
      TSQLRestServer.SQLAuthUserClass/SQLAuthGroupClass new properties
    - introducing TSQLAuthUser.CanUserLog() to ensure authentication is allowed,
      as requested by feature request [842906425928]
    - added TSynAuthenticationRest e.g. for SynDBRemote to check REST users
    - added TSQLRestServer.OnSessionCreate / OnSessionClosed / OnSessionFailed
      callbacks, and TSQLRestServerURIContext.AuthenticationFailed virtual method
    - added TSQLRestServer.SessionClass property to specify the class type
      to handle in-memory sessions, and override e.g. IsValidURI() method
    - CreateMissingTables() method is not declared as virtual in TSQLRestServer
    - TSQLRestServer.URI() and TSQLRestClientURI.InternalURI() methods now uses
      one TSQLRestURIParams parameter for all request input and output values
    - TSQLRestServer.URI() method will return "405 Method Not Allowed" error
................................................................................
  // !  context := @ServiceContext; // threadvar access once
  // !  ...
  PServiceRunningContext = ^TServiceRunningContext;

  TSQLRestServerURIContext = class;
  TAuthSession = class;









  /// will identify the currently running service on the server side
  // - is the type of the global ServiceContext threadvar
  // - to access the current TSQLRestServer instance (and e.g. its ORM/CRUD
  // or SOA methods), use Request.Server and not Factory.Server, which may not
  // be available e.g. if you run the service from the server side (so no
  // factory is involved)
  TServiceRunningContext = record
................................................................................
    // - should set Service member (and possibly ServiceMethodIndex)
    // - abstract implementation which is to be overridden
    procedure URIDecodeSOAByInterface; virtual; abstract;
    /// process authentication
    // - return FALSE in case of invalid signature, TRUE if authenticated
    function Authenticate: boolean; virtual;
    /// method called in case of authentication failure

    // - this default implementation will just set OutStatus := HTML_FORBIDDEN
    // and call Server.OnSessionFailed event

    procedure AuthenticationFailed; virtual;
    /// direct launch of a method-based service
    // - URI() will ensure that MethodIndex>=0 before calling it
    procedure ExecuteSOAByMethod; virtual;
    /// direct launch of an interface-based service
    // - URI() will ensure that Service<>nil before calling it
    // - abstract implementation which is to be overridden
    procedure ExecuteSOAByInterface; virtual; abstract;
................................................................................
  TNotifyFieldSQLEvent = function(Sender: TSQLRestServer; Event: TSQLEvent;
    aTable: TSQLRecordClass; const aID: TID; const aAffectedFields: TSQLFieldBits): boolean of object;
  /// session-related callbacks triggered by TSQLRestServer
  // - for OnSessionCreate, returning TRUE will abort the session creation -
  // and you can set Ctxt.Call^.OutStatus to a corresponding error code
  TNotifySQLSession = function(Sender: TSQLRestServer; Session: TAuthSession;
    Ctxt: TSQLRestServerURIContext): boolean of object;






  TSQLRestStorageInMemory = class;
  TSQLVirtualTableModule = class;

  /// class-reference type (metaclass) of our abstract table storage
  // - may be e.g. TSQLRestStorageInMemory, TSQLRestStorageInMemoryExternal,
  // TSQLRestStorageExternal or TSQLRestStorageMongoDB
................................................................................
    // TSQLAuthGroup instance for fast retrieval in TSQLRestServer.URI
    function GetUser(Ctxt: TSQLRestServerURIContext;
      const aUserName: RawUTF8): TSQLAuthUser; virtual;
    /// create a session on the server for a given user
    // - this default implementation will call fServer.SessionCreate() and
    // return a '{"result":"HEXASALT","logonname":"UserName"}' JSON content
    // and will always call User.Free


    procedure SessionCreate(Ctxt: TSQLRestServerURIContext; var User: TSQLAuthUser); virtual;
    /// abstract method which will be called by ClientSetUser() to process the
    // authentication step on the client side
    // - at call, a TSQLAuthUser instance will be supplied, with LogonName set
    // with aUserName and PasswordHashHexa with a SHA-256 hash of aPassword
    // - override with the expected method, returning the session key on success
    class function ClientComputeSessionKey(Sender: TSQLRestClientURI; User: TSQLAuthUser): RawUTF8;
................................................................................
    /// this method is overridden for setting the NoAJAXJSON field
    // of all associated TSQLRestStorage servers
    procedure SetNoAJAXJSON(const Value: boolean); virtual;
    /// add a new session to the internal session list
    // - do not use this method directly: this callback is to be used by
    // TSQLRestServerAuthentication* classes
    // - will check that the logon name is valid


    procedure SessionCreate(var User: TSQLAuthUser; Ctxt: TSQLRestServerURIContext;
      out Session: TAuthSession); virtual;
    /// fill the supplied context from the supplied aContext.Session ID
    // - returns nil if not found, or fill aContext.User/Group values if matchs
    // - this method will also check for outdated sessions, and delete them
    // - this method is not thread-safe: caller should use fSessions.Lock
    function SessionAccess(Ctxt: TSQLRestServerURIContext): TAuthSession;
................................................................................
    // (DenyOfService attack?) or the request is not valid (ManIntheMiddle attack?)
    // - e.g. if the URI signature is invalid, or OnSessionCreate event handler
    // aborted the session creation by returning TRUE (in this later case,
    // the Session parameter is not nil)
    // - you can access the current execution context from the Ctxt parameter,
    // e.g. to retrieve the caller's IP and ban aggressive users:
    // ! FindIniNameValue(pointer(Ctxt.Call^.InHead),'REMOTEIP: ')
    OnSessionFailed: TNotifySQLSession;
    /// a method can be specified to be notified when a session is closed
    // - for OnSessionClosed, the returning boolean value is ignored
    // - Ctxt is nil if the session is closed due to a timeout
    // - Ctxt is not nil if the session is closed explicitly by the client
    OnSessionClosed: TNotifySQLSession;
    /// this event will be executed to push notifications from the server to
    // a remote client, using a (fake) interface parameter
................................................................................
      result := Server.fPublishedMethod[MethodIndex].ByPassAuthentication;
  end else begin // default unique session if authentication is not enabled
    Session := CONST_AUTHENTICATION_NOT_USED;
    result := true;
  end;
end;

procedure TSQLRestServerURIContext.AuthenticationFailed;

begin
  // 401 Unauthorized response MUST include a WWW-Authenticate header,
  // which is not what we used, so here we won't send 401 error code but 403
  Call.OutStatus := HTML_FORBIDDEN;
  // call the notification event
  if Assigned(Server.OnSessionFailed) then
    Server.OnSessionFailed(Server,nil,self);
end;

destructor TSQLRestAcquireExecution.Destroy;
begin
  inherited Destroy;
  Thread.Free;
end;
................................................................................
    if (RootRedirectGet<>'') and (Ctxt.Method=mGet) and
       (Call.Url=Model.Root) and (Call.InBody='') then
      Ctxt.Redirect(RootRedirectGet) else begin
      Ctxt.URIDecodeSOAByMethod;
      if (Ctxt.MethodIndex<0) and (Ctxt.URI<>'') then
        Ctxt.URIDecodeSOAByInterface;
      // 2. handle security
      if (not Ctxt.Authenticate) or

         ((Ctxt.Service<>nil) and
           not (reService in Call.RestAccessRights^.AllowRemoteExecute)) then
        Ctxt.AuthenticationFailed else
      // 3. call appropriate ORM / SOA commands in fAcquireExecution[] context
      try
        if Ctxt.MethodIndex>=0 then
          if Ctxt.MethodIndex=fPublishedMethodBatchIndex then
            Ctxt.Command := execORMWrite else
            Ctxt.Command := execSOAByMethod else
        if Ctxt.Service<>nil then
................................................................................
    for i := 0 to fSessions.Count-1 do
      if TAuthSession(fSessions.List[i]).User.fID=User.fID then begin
        {$ifdef WITHLOG}
        with TAuthSession(fSessions.List[i]) do
          Ctxt.Log.Log(sllUserAuth,'User.LogonName=% already connected from "%/%"',
            [User.LogonName,RemoteIP,Ctxt.Call^.LowLevelConnectionID],self);
        {$endif}
        Ctxt.Call^.OutStatus := HTML_NOTALLOWED;
        if Assigned(OnSessionFailed) then
          OnSessionFailed(self,nil,Ctxt);
        exit; // user already connected -> error 404
      end;
  Session := fSessionClass.Create(Ctxt,User);
  if Assigned(OnSessionCreate) then
    if OnSessionCreate(self,Session,Ctxt) then begin
      {$ifdef WITHLOG}
      Ctxt.Log.Log(sllUserAuth,'Session aborted by OnSessionCreate() callback '+
         'for User.LogonName=% (connected from "%/%") - clients=%, sessions=%',
        [User.LogonName,Session.RemoteIP,Ctxt.Call^.LowLevelConnectionID,
         fStats.ClientsCurrent,fSessions.Count],self);
      {$endif}
      if Assigned(OnSessionFailed) then
        OnSessionFailed(self,Session,Ctxt);
      User := nil;
      FreeAndNil(Session); // returning TRUE aborts the session creation
      exit;
    end;
  User := nil; // will be freed by TAuthSession.Destroy
  fSessions.Add(Session);
  fStats.ClientConnect;
end;

................................................................................

constructor TAuthSession.Create(aCtxt: TSQLRestServerURIContext; aUser: TSQLAuthUser);
var GID: TSQLAuthGroup;
begin
  fUser := aUser;
  if (aCtxt<>nil) and (User<>nil) and (User.fID<>0) then begin
    GID := User.GroupRights; // save pseudo TSQLAuthGroup = ID
    User.GroupRights := aCtxt.Server.fSQLAuthGroupClass.Create(aCtxt.Server,User.GroupRights);
    if User.GroupRights.fID<>0 then begin
      // compute the next Session ID
      with aCtxt.Server do begin
        if fSessionCounter>=cardinal(maxInt) then
          fSessionCounter := 10 else
          if fSessionCounter=75 then // avoid IDCardinal=0 (77) or 1 (76)
            fSessionCounter := 78 else
................................................................................
end;

procedure TSQLRestServerAuthentication.SessionCreate(Ctxt: TSQLRestServerURIContext;
  var User: TSQLAuthUser);
var Session: TAuthSession;
begin
  if User<>nil then
  try
    // now client is authenticated -> create a session
    fServer.SessionCreate(User,Ctxt,Session);
    if Session<>nil then
      Ctxt.Returns(['result',Session.fPrivateSalt,'logonname',Session.User.LogonName]);
  finally
    User.Free;
  end;
end;

................................................................................
  aClientNonce := Ctxt.InputUTF8OrVoid['ClientNonce'];
  if (aUserName<>'') and (aClientNonce<>'') then begin
    // GET ModelRoot/auth?UserName=...&PassWord=...&ClientNonce=... -> handshaking
    User := GetUser(Ctxt,aUserName);
    if User<>nil then
    try
      // check if match TSQLRestClientURI.SetUser() algorithm
      if CheckPassword(Ctxt,User,aClientNonce,aPassWord) then begin
        // now client is authenticated -> create a session
        SessionCreate(Ctxt,User);
        exit;
      end;

    finally
      User.Free;
    end;
    Ctxt.AuthenticationFailed;
  end else
    if aUserName<>'' then
      // only UserName=... -> return hexadecimal nonce content valid for 5 minutes
      Ctxt.Results([Nonce(false)]) else
      // parameters does not match any expected layout -> try next authentication
      result := false;
end;
................................................................................

function TSQLRestServerAuthenticationNone.Auth(Ctxt: TSQLRestServerURIContext): boolean;
var aUserName: RawUTF8;
    U: TSQLAuthUser;
begin
  aUserName := Ctxt.InputUTF8OrVoid['UserName'];
  if aUserName='' then begin
    result := false;
    exit;
  end;
  result := true;
  if AuthSessionRelease(Ctxt) then
    exit;
  U := GetUser(Ctxt,aUserName);


  SessionCreate(Ctxt,U);
end;

class function TSQLRestServerAuthenticationNone.ClientComputeSessionKey(
  Sender: TSQLRestClientURI; User: TSQLAuthUser): RawUTF8;
begin
  result := Sender.CallBackGetResult('Auth',['UserName',User.LogonName]);
end;
................................................................................
  if GetUserPassFromInHead(Ctxt,userPass,user,pass) then begin
    U := GetUser(Ctxt,user);
    if U<>nil then
    try
      expectedPass := U.PasswordHashHexa;
      U.PasswordPlain := pass; // override with SHA-256 hash from HTTP header
      if U.PasswordHashHexa=expectedPass then begin
        fServer.SessionCreate(U,Ctxt,Session);
        if Session<>nil then begin
          // see TSQLRestServerAuthenticationHttpAbstract.ClientSessionSign()
          Ctxt.SetOutSetCookie((COOKIE_SESSION+'=')+CardinalToHex(Session.IDCardinal));
          Ctxt.Returns(['result',Session.IDCardinal,'logonname',Session.User.LogonName]);
          exit; // success
        end;
      end;

    finally
      U.Free;
    end;
    Ctxt.AuthenticationFailed;
  end else begin
    Ctxt.Call.OutHead := 'WWW-Authenticate: Basic realm="mORMot Server"';;
    Ctxt.Error('',HTML_UNAUTHORIZED); // will popup for credentials in browser
  end;
end;


................................................................................
  try
    if UserName='' then
      exit;
    User := GetUser(Ctxt,UserName);
    if User<>nil then
    try
      User.PasswordHashHexa := ''; // override with context
      fServer.SessionCreate(User,Ctxt,Session);
      if Session<>nil then begin
        if BrowserAuth then
          Ctxt.Returns(JSONEncode(['result',Session.fPrivateSalt,
            'logonname',Session.User.LogonName]),HTML_SUCCESS,
            (SECPKGNAMEHTTPWWWAUTHENTICATE+' ')+BinToBase64(OutData)) else
          Ctxt.Returns([
            'result',BinToBase64(SecEncrypt(fSSPIAuthContexts[SecCtxIdx],Session.fPrivateSalt)),
            'logonname',Session.User.LogonName,'data',BinToBase64(OutData)]);
        exit;
      end;
    finally
      User.Free;
    end;
    Ctxt.AuthenticationFailed;
  finally
    FreeSecContext(fSSPIAuthContexts[SecCtxIdx]);
    CtxArr.Delete(SecCtxIdx);
  end;
end;

class function TSQLRestServerAuthenticationSSPI.ClientComputeSessionKey(

      TSQLAuthUser and/or TSQLAuthGroup classes to store the authorization
      information: TSQLRestServer will search for any table inheriting from
      TSQLAuthUser/TSQLAuthGroup in the TSQLModel - see also corresponding
      TSQLRestServer.SQLAuthUserClass/SQLAuthGroupClass new properties
    - introducing TSQLAuthUser.CanUserLog() to ensure authentication is allowed,
      as requested by feature request [842906425928]
    - added TSynAuthenticationRest e.g. for SynDBRemote to check REST users
    - added TSQLRestServer.OnSessionCreate/OnSessionClosed/OnAuthenticationFailed
      callbacks, and TSQLRestServerURIContext.AuthenticationFailed virtual method
    - added TSQLRestServer.SessionClass property to specify the class type
      to handle in-memory sessions, and override e.g. IsValidURI() method
    - CreateMissingTables() method is not declared as virtual in TSQLRestServer
    - TSQLRestServer.URI() and TSQLRestClientURI.InternalURI() methods now uses
      one TSQLRestURIParams parameter for all request input and output values
    - TSQLRestServer.URI() method will return "405 Method Not Allowed" error
................................................................................
  // !  context := @ServiceContext; // threadvar access once
  // !  ...
  PServiceRunningContext = ^TServiceRunningContext;

  TSQLRestServerURIContext = class;
  TAuthSession = class;

  /// used to identify the authentication failure reason
  // - as transmitted e.g. by TSQLRestServerURIContext.AuthenticationFailed or
  // TSQLRestServer.OnAuthenticationFailed
  TNotifyAuthenticationFailedReason = (
   afInvalidSignature,afRemoteServiceExecutionNotAllowed,
   afUnknownUser,afInvalidPassword,
   afSessionAlreadyStartedForThisUser,afSessionCreationAborted);

  /// will identify the currently running service on the server side
  // - is the type of the global ServiceContext threadvar
  // - to access the current TSQLRestServer instance (and e.g. its ORM/CRUD
  // or SOA methods), use Request.Server and not Factory.Server, which may not
  // be available e.g. if you run the service from the server side (so no
  // factory is involved)
  TServiceRunningContext = record
................................................................................
    // - should set Service member (and possibly ServiceMethodIndex)
    // - abstract implementation which is to be overridden
    procedure URIDecodeSOAByInterface; virtual; abstract;
    /// process authentication
    // - return FALSE in case of invalid signature, TRUE if authenticated
    function Authenticate: boolean; virtual;
    /// method called in case of authentication failure
    // - the failure origin is stated by the Reason parameter
    // - this default implementation will just set OutStatus := HTML_FORBIDDEN

    // and call TSQLRestServer.OnAuthenticationFailed event (if any)
    procedure AuthenticationFailed(Reason: TNotifyAuthenticationFailedReason); virtual;
    /// direct launch of a method-based service
    // - URI() will ensure that MethodIndex>=0 before calling it
    procedure ExecuteSOAByMethod; virtual;
    /// direct launch of an interface-based service
    // - URI() will ensure that Service<>nil before calling it
    // - abstract implementation which is to be overridden
    procedure ExecuteSOAByInterface; virtual; abstract;
................................................................................
  TNotifyFieldSQLEvent = function(Sender: TSQLRestServer; Event: TSQLEvent;
    aTable: TSQLRecordClass; const aID: TID; const aAffectedFields: TSQLFieldBits): boolean of object;
  /// session-related callbacks triggered by TSQLRestServer
  // - for OnSessionCreate, returning TRUE will abort the session creation -
  // and you can set Ctxt.Call^.OutStatus to a corresponding error code
  TNotifySQLSession = function(Sender: TSQLRestServer; Session: TAuthSession;
    Ctxt: TSQLRestServerURIContext): boolean of object;
  /// callback raised in case of authentication failure
  // - as used by TSQLRestServerURIContext.AuthenticationFailed event
  TNotifyAuthenticationFailed = procedure(Sender: TSQLRestServer;
    Reason: TNotifyAuthenticationFailedReason; Session: TAuthSession;
    Ctxt: TSQLRestServerURIContext) of object;

  TSQLRestStorageInMemory = class;
  TSQLVirtualTableModule = class;

  /// class-reference type (metaclass) of our abstract table storage
  // - may be e.g. TSQLRestStorageInMemory, TSQLRestStorageInMemoryExternal,
  // TSQLRestStorageExternal or TSQLRestStorageMongoDB
................................................................................
    // TSQLAuthGroup instance for fast retrieval in TSQLRestServer.URI
    function GetUser(Ctxt: TSQLRestServerURIContext;
      const aUserName: RawUTF8): TSQLAuthUser; virtual;
    /// create a session on the server for a given user
    // - this default implementation will call fServer.SessionCreate() and
    // return a '{"result":"HEXASALT","logonname":"UserName"}' JSON content
    // and will always call User.Free
    // - on failure, will call TSQLRestServerURIContext.AuthenticationFailed()
    // with afSessionAlreadyStartedForThisUser or afSessionCreationAborted reason
    procedure SessionCreate(Ctxt: TSQLRestServerURIContext; var User: TSQLAuthUser); virtual;
    /// abstract method which will be called by ClientSetUser() to process the
    // authentication step on the client side
    // - at call, a TSQLAuthUser instance will be supplied, with LogonName set
    // with aUserName and PasswordHashHexa with a SHA-256 hash of aPassword
    // - override with the expected method, returning the session key on success
    class function ClientComputeSessionKey(Sender: TSQLRestClientURI; User: TSQLAuthUser): RawUTF8;
................................................................................
    /// this method is overridden for setting the NoAJAXJSON field
    // of all associated TSQLRestStorage servers
    procedure SetNoAJAXJSON(const Value: boolean); virtual;
    /// add a new session to the internal session list
    // - do not use this method directly: this callback is to be used by
    // TSQLRestServerAuthentication* classes
    // - will check that the logon name is valid
    // - on failure, will call TSQLRestServerURIContext.AuthenticationFailed()
    // with afSessionAlreadyStartedForThisUser or afSessionCreationAborted reason
    procedure SessionCreate(var User: TSQLAuthUser; Ctxt: TSQLRestServerURIContext;
      out Session: TAuthSession); virtual;
    /// fill the supplied context from the supplied aContext.Session ID
    // - returns nil if not found, or fill aContext.User/Group values if matchs
    // - this method will also check for outdated sessions, and delete them
    // - this method is not thread-safe: caller should use fSessions.Lock
    function SessionAccess(Ctxt: TSQLRestServerURIContext): TAuthSession;
................................................................................
    // (DenyOfService attack?) or the request is not valid (ManIntheMiddle attack?)
    // - e.g. if the URI signature is invalid, or OnSessionCreate event handler
    // aborted the session creation by returning TRUE (in this later case,
    // the Session parameter is not nil)
    // - you can access the current execution context from the Ctxt parameter,
    // e.g. to retrieve the caller's IP and ban aggressive users:
    // ! FindIniNameValue(pointer(Ctxt.Call^.InHead),'REMOTEIP: ')
    OnAuthenticationFailed: TNotifyAuthenticationFailed;
    /// a method can be specified to be notified when a session is closed
    // - for OnSessionClosed, the returning boolean value is ignored
    // - Ctxt is nil if the session is closed due to a timeout
    // - Ctxt is not nil if the session is closed explicitly by the client
    OnSessionClosed: TNotifySQLSession;
    /// this event will be executed to push notifications from the server to
    // a remote client, using a (fake) interface parameter
................................................................................
      result := Server.fPublishedMethod[MethodIndex].ByPassAuthentication;
  end else begin // default unique session if authentication is not enabled
    Session := CONST_AUTHENTICATION_NOT_USED;
    result := true;
  end;
end;

procedure TSQLRestServerURIContext.AuthenticationFailed(
  Reason: TNotifyAuthenticationFailedReason);
begin
  // 401 Unauthorized response MUST include a WWW-Authenticate header,
  // which is not what we used, so here we won't send 401 error code but 403
  Call.OutStatus := HTML_FORBIDDEN;
  // call the notification event
  if Assigned(Server.OnAuthenticationFailed) then
    Server.OnAuthenticationFailed(Server,Reason,nil,self);
end;

destructor TSQLRestAcquireExecution.Destroy;
begin
  inherited Destroy;
  Thread.Free;
end;
................................................................................
    if (RootRedirectGet<>'') and (Ctxt.Method=mGet) and
       (Call.Url=Model.Root) and (Call.InBody='') then
      Ctxt.Redirect(RootRedirectGet) else begin
      Ctxt.URIDecodeSOAByMethod;
      if (Ctxt.MethodIndex<0) and (Ctxt.URI<>'') then
        Ctxt.URIDecodeSOAByInterface;
      // 2. handle security
      if not Ctxt.Authenticate then
        Ctxt.AuthenticationFailed(afInvalidSignature) else
      if (Ctxt.Service<>nil) and
          not (reService in Call.RestAccessRights^.AllowRemoteExecute) then
        Ctxt.AuthenticationFailed(afRemoteServiceExecutionNotAllowed) else
      // 3. call appropriate ORM / SOA commands in fAcquireExecution[] context
      try
        if Ctxt.MethodIndex>=0 then
          if Ctxt.MethodIndex=fPublishedMethodBatchIndex then
            Ctxt.Command := execORMWrite else
            Ctxt.Command := execSOAByMethod else
        if Ctxt.Service<>nil then
................................................................................
    for i := 0 to fSessions.Count-1 do
      if TAuthSession(fSessions.List[i]).User.fID=User.fID then begin
        {$ifdef WITHLOG}
        with TAuthSession(fSessions.List[i]) do
          Ctxt.Log.Log(sllUserAuth,'User.LogonName=% already connected from "%/%"',
            [User.LogonName,RemoteIP,Ctxt.Call^.LowLevelConnectionID],self);
        {$endif}
        Ctxt.AuthenticationFailed(afSessionAlreadyStartedForThisUser);


        exit; // user already connected 
      end;
  Session := fSessionClass.Create(Ctxt,User);
  if Assigned(OnSessionCreate) then
    if OnSessionCreate(self,Session,Ctxt) then begin // TRUE aborts session creation
      {$ifdef WITHLOG}
      Ctxt.Log.Log(sllUserAuth,'Session aborted by OnSessionCreate() callback '+
         'for User.LogonName=% (connected from "%/%") - clients=%, sessions=%',
        [User.LogonName,Session.RemoteIP,Ctxt.Call^.LowLevelConnectionID,
         fStats.ClientsCurrent,fSessions.Count],self);
      {$endif}
      Ctxt.AuthenticationFailed(afSessionCreationAborted);

      User := nil;
      FreeAndNil(Session);
      exit;
    end;
  User := nil; // will be freed by TAuthSession.Destroy
  fSessions.Add(Session);
  fStats.ClientConnect;
end;

................................................................................

constructor TAuthSession.Create(aCtxt: TSQLRestServerURIContext; aUser: TSQLAuthUser);
var GID: TSQLAuthGroup;
begin
  fUser := aUser;
  if (aCtxt<>nil) and (User<>nil) and (User.fID<>0) then begin
    GID := User.GroupRights; // save pseudo TSQLAuthGroup = ID
    User.GroupRights := aCtxt.Server.fSQLAuthGroupClass.Create(aCtxt.Server,GID);
    if User.GroupRights.fID<>0 then begin
      // compute the next Session ID
      with aCtxt.Server do begin
        if fSessionCounter>=cardinal(maxInt) then
          fSessionCounter := 10 else
          if fSessionCounter=75 then // avoid IDCardinal=0 (77) or 1 (76)
            fSessionCounter := 78 else
................................................................................
end;

procedure TSQLRestServerAuthentication.SessionCreate(Ctxt: TSQLRestServerURIContext;
  var User: TSQLAuthUser);
var Session: TAuthSession;
begin
  if User<>nil then

  try // now client is authenticated -> create a session
    fServer.SessionCreate(User,Ctxt,Session); // call Ctxt.AuthenticationFailed on error
    if Session<>nil then
      Ctxt.Returns(['result',Session.fPrivateSalt,'logonname',Session.User.LogonName]);
  finally
    User.Free;
  end;
end;

................................................................................
  aClientNonce := Ctxt.InputUTF8OrVoid['ClientNonce'];
  if (aUserName<>'') and (aClientNonce<>'') then begin
    // GET ModelRoot/auth?UserName=...&PassWord=...&ClientNonce=... -> handshaking
    User := GetUser(Ctxt,aUserName);
    if User<>nil then
    try
      // check if match TSQLRestClientURI.SetUser() algorithm
      if CheckPassword(Ctxt,User,aClientNonce,aPassWord) then

        SessionCreate(Ctxt,User) else // will call Ctxt.AuthenticationFailed on error


        Ctxt.AuthenticationFailed(afInvalidPassword);
    finally
      User.Free;
    end else
      Ctxt.AuthenticationFailed(afUnknownUser);
  end else
    if aUserName<>'' then
      // only UserName=... -> return hexadecimal nonce content valid for 5 minutes
      Ctxt.Results([Nonce(false)]) else
      // parameters does not match any expected layout -> try next authentication
      result := false;
end;
................................................................................

function TSQLRestServerAuthenticationNone.Auth(Ctxt: TSQLRestServerURIContext): boolean;
var aUserName: RawUTF8;
    U: TSQLAuthUser;
begin
  aUserName := Ctxt.InputUTF8OrVoid['UserName'];
  if aUserName='' then begin
    result := false; // let's try another TSQLRestServerAuthentication class
    exit;
  end;
  result := true; // this kind of weak authentication avoid stronger ones 
  if AuthSessionRelease(Ctxt) then
    exit;
  U := GetUser(Ctxt,aUserName);
  if U=nil then
    Ctxt.AuthenticationFailed(afUnknownUser) else
    SessionCreate(Ctxt,U); // call Ctxt.AuthenticationFailed on error
end;

class function TSQLRestServerAuthenticationNone.ClientComputeSessionKey(
  Sender: TSQLRestClientURI; User: TSQLAuthUser): RawUTF8;
begin
  result := Sender.CallBackGetResult('Auth',['UserName',User.LogonName]);
end;
................................................................................
  if GetUserPassFromInHead(Ctxt,userPass,user,pass) then begin
    U := GetUser(Ctxt,user);
    if U<>nil then
    try
      expectedPass := U.PasswordHashHexa;
      U.PasswordPlain := pass; // override with SHA-256 hash from HTTP header
      if U.PasswordHashHexa=expectedPass then begin
        fServer.SessionCreate(U,Ctxt,Session); // call Ctxt.AuthenticationFailed on error
        if Session<>nil then begin
          // see TSQLRestServerAuthenticationHttpAbstract.ClientSessionSign()
          Ctxt.SetOutSetCookie((COOKIE_SESSION+'=')+CardinalToHex(Session.IDCardinal));
          Ctxt.Returns(['result',Session.IDCardinal,'logonname',Session.User.LogonName]);
          exit; // success
        end;
      end else
        Ctxt.AuthenticationFailed(afInvalidPassword);
    finally
      U.Free;
    end else
      Ctxt.AuthenticationFailed(afUnknownUser);
  end else begin
    Ctxt.Call.OutHead := 'WWW-Authenticate: Basic realm="mORMot Server"';;
    Ctxt.Error('',HTML_UNAUTHORIZED); // will popup for credentials in browser
  end;
end;


................................................................................
  try
    if UserName='' then
      exit;
    User := GetUser(Ctxt,UserName);
    if User<>nil then
    try
      User.PasswordHashHexa := ''; // override with context
      fServer.SessionCreate(User,Ctxt,Session); // call Ctxt.AuthenticationFailed on error
      if Session<>nil then
        if BrowserAuth then
          Ctxt.Returns(JSONEncode(['result',Session.fPrivateSalt,
            'logonname',Session.User.LogonName]),HTML_SUCCESS,
            (SECPKGNAMEHTTPWWWAUTHENTICATE+' ')+BinToBase64(OutData)) else
          Ctxt.Returns([
            'result',BinToBase64(SecEncrypt(fSSPIAuthContexts[SecCtxIdx],Session.fPrivateSalt)),
            'logonname',Session.User.LogonName,'data',BinToBase64(OutData)]);


    finally
      User.Free;
    end else
      Ctxt.AuthenticationFailed(afUnknownUser);
  finally
    FreeSecContext(fSSPIAuthContexts[SecCtxIdx]);
    CtxArr.Delete(SecCtxIdx);
  end;
end;

class function TSQLRestServerAuthenticationSSPI.ClientComputeSessionKey(

'1.18.1258'

'1.18.1259'