141 lines
4.4 KiB
Rust
141 lines
4.4 KiB
Rust
use axum::extract::FromRequestParts;
|
|
use axum::http::request::Parts;
|
|
use domain::{DomainError, User};
|
|
|
|
use crate::errors::AppError;
|
|
use crate::state::AppState;
|
|
|
|
pub struct CurrentUser(pub User);
|
|
|
|
impl FromRequestParts<AppState> for CurrentUser {
|
|
type Rejection = AppError;
|
|
|
|
async fn from_request_parts(
|
|
parts: &mut Parts,
|
|
state: &AppState,
|
|
) -> Result<Self, Self::Rejection> {
|
|
#[cfg(feature = "auth-jwt")]
|
|
{
|
|
return match try_jwt_auth(parts, state).await {
|
|
Ok(user) => Ok(CurrentUser(user)),
|
|
Err(e) => Err(e),
|
|
};
|
|
}
|
|
|
|
#[cfg(not(feature = "auth-jwt"))]
|
|
{
|
|
let _ = (parts, state);
|
|
Err(AppError(DomainError::Unauthenticated(
|
|
"No authentication backend configured".to_string(),
|
|
)))
|
|
}
|
|
}
|
|
}
|
|
|
|
pub struct OptionalCurrentUser(pub Option<User>);
|
|
|
|
impl FromRequestParts<AppState> for OptionalCurrentUser {
|
|
type Rejection = AppError;
|
|
|
|
async fn from_request_parts(
|
|
parts: &mut Parts,
|
|
state: &AppState,
|
|
) -> Result<Self, Self::Rejection> {
|
|
#[cfg(feature = "auth-jwt")]
|
|
{
|
|
if let Ok(user) = try_jwt_auth(parts, state).await {
|
|
return Ok(OptionalCurrentUser(Some(user)));
|
|
}
|
|
let query_token = parts.uri.query().and_then(|q| {
|
|
q.split('&')
|
|
.find_map(|seg| seg.strip_prefix("token="))
|
|
.map(|v| v.to_owned())
|
|
});
|
|
if let Some(token) = query_token {
|
|
let user = validate_jwt_token(&token, state).await.ok();
|
|
return Ok(OptionalCurrentUser(user));
|
|
}
|
|
Ok(OptionalCurrentUser(None))
|
|
}
|
|
|
|
#[cfg(not(feature = "auth-jwt"))]
|
|
{
|
|
let _ = (parts, state);
|
|
Ok(OptionalCurrentUser(None))
|
|
}
|
|
}
|
|
}
|
|
|
|
pub struct AdminUser(pub User);
|
|
|
|
impl FromRequestParts<AppState> for AdminUser {
|
|
type Rejection = AppError;
|
|
|
|
async fn from_request_parts(
|
|
parts: &mut Parts,
|
|
state: &AppState,
|
|
) -> Result<Self, Self::Rejection> {
|
|
let CurrentUser(user) = CurrentUser::from_request_parts(parts, state).await?;
|
|
if !user.is_admin() {
|
|
return Err(AppError(DomainError::Forbidden("Admin access required".to_string())));
|
|
}
|
|
Ok(AdminUser(user))
|
|
}
|
|
}
|
|
|
|
#[cfg(feature = "auth-jwt")]
|
|
async fn try_jwt_auth(parts: &mut Parts, state: &AppState) -> Result<User, AppError> {
|
|
use axum::http::header::AUTHORIZATION;
|
|
|
|
let auth_header = parts
|
|
.headers
|
|
.get(AUTHORIZATION)
|
|
.ok_or_else(|| AppError(DomainError::Unauthenticated("Missing Authorization header".to_string())))?;
|
|
|
|
let auth_str = auth_header
|
|
.to_str()
|
|
.map_err(|_| AppError(DomainError::Unauthenticated("Invalid Authorization header encoding".to_string())))?;
|
|
|
|
let token = auth_str.strip_prefix("Bearer ").ok_or_else(|| {
|
|
AppError(DomainError::Unauthenticated("Authorization header must use Bearer scheme".to_string()))
|
|
})?;
|
|
|
|
validate_jwt_token(token, state).await
|
|
}
|
|
|
|
#[cfg(feature = "auth-jwt")]
|
|
pub(crate) async fn validate_jwt_token(token: &str, state: &AppState) -> Result<User, AppError> {
|
|
let validator = state
|
|
.jwt_validator
|
|
.as_ref()
|
|
.ok_or_else(|| AppError(DomainError::InfrastructureError("JWT validator not configured".to_string())))?;
|
|
|
|
let claims = validator.validate_access_token(token).map_err(|e| {
|
|
tracing::debug!("JWT validation failed: {:?}", e);
|
|
match e {
|
|
adapter_auth::JwtError::Expired => {
|
|
AppError(DomainError::Unauthenticated("Token expired".to_string()))
|
|
}
|
|
adapter_auth::JwtError::InvalidFormat => {
|
|
AppError(DomainError::Unauthenticated("Invalid token format".to_string()))
|
|
}
|
|
_ => AppError(DomainError::Unauthenticated("Token validation failed".to_string())),
|
|
}
|
|
})?;
|
|
|
|
let user_id: uuid::Uuid = claims
|
|
.sub
|
|
.parse()
|
|
.map_err(|_| AppError(DomainError::Unauthenticated("Invalid user ID in token".to_string())))?;
|
|
|
|
let user = state
|
|
.auth_deps
|
|
.user_query
|
|
.find_by_id(domain::UserId::from(user_id))
|
|
.await
|
|
.map_err(|e| AppError(DomainError::InfrastructureError(format!("Failed to fetch user: {}", e))))?
|
|
.ok_or_else(|| AppError(DomainError::Unauthenticated("User not found".to_string())))?;
|
|
|
|
Ok(user)
|
|
}
|