Struct mailpot_web::auth::auth_request::RequireAuthorizationLayer

pub struct RequireAuthorizationLayer<UserId, User, Role = ()>(UserId, User, Role);

A wrapper around tower_http::auth::RequireAuthorizationLayer which provides login authorization.

Tuple Fields

0: UserId

1: User

2: Role

Implementations

impl<UserId, User, Role> RequireAuthorizationLayer<UserId, User, Role>where Role: PartialOrd + PartialEq + Clone + Send + Sync + 'static, User: AuthUser<UserId, Role>,

pub fn login<ResBody>( ) -> RequireAuthorizationLayer<Login<UserId, User, ResBody, Role>>where ResBody: HttpBody + Default,

Authorizes requests by requiring a logged in user, otherwise it rejects with http::StatusCode::UNAUTHORIZED.

pub fn login_with_role<ResBody>( role_bounds: impl RangeBounds<Role> + Clone + Send + Sync + 'static ) -> RequireAuthorizationLayer<Login<UserId, User, ResBody, Role>>where ResBody: HttpBody + Default,

Authorizes requests by requiring a logged in user to have a specific range of roles, otherwise it rejects with http::StatusCode::UNAUTHORIZED.

pub fn login_or_redirect<ResBody>( login_url: Arc<Cow<'static, str>>, redirect_field_name: Option<Arc<Cow<'static, str>>> ) -> RequireAuthorizationLayer<Login<UserId, User, ResBody, Role>>where ResBody: HttpBody + Default,

Authorizes requests by requiring a logged in user, otherwise it redirects to the provided login URL.

If redirect_field_name is set to a value, the login page will receive the path it was redirected from in the URI query part. For example, attempting to visit a protected path /protected would redirect you to /login?next=/protected allowing you to know how to return the visitor to their requested page.

Examples found in repository

web/src/main.rs (lines 107-110)

fn create_app(shared_state: Arc<AppState>) -> Router {
    let store = MemoryStore::new();
    let secret = rand::thread_rng().gen::<[u8; 128]>();
    let session_layer = SessionLayer::new(store, &secret).with_secure(false);

    let auth_layer = AuthLayer::new(shared_state.clone(), &secret);

    let login_url =
        Arc::new(format!("{}{}", shared_state.root_url_prefix, LoginPath.to_crumb()).into());
    Router::new()
        .route("/", get(root))
        .typed_get(list)
        .typed_get(list_post)
        .typed_get(list_post_raw)
        .typed_get(list_topics)
        .typed_get(list_post_eml)
        .typed_get(list_edit.layer(RequireAuth::login_with_role_or_redirect(
            Role::User..,
            Arc::clone(&login_url),
            Some(Arc::new("next".into())),
        )))
        .typed_post(
            {
                let shared_state = Arc::clone(&shared_state);
                move |path, session, user, payload| {
                    list_edit_POST(path, session, user, payload, State(shared_state))
                }
            }
            .layer(RequireAuth::login_with_role_or_redirect(
                Role::User..,
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_get(
            list_subscribers.layer(RequireAuth::login_with_role_or_redirect(
                Role::User..,
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_get(
            list_candidates.layer(RequireAuth::login_with_role_or_redirect(
                Role::User..,
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_get(help)
        .typed_get(auth::ssh_signin)
        .typed_post({
            let shared_state = Arc::clone(&shared_state);
            move |path, session, query, auth, body| {
                auth::ssh_signin_POST(path, session, query, auth, body, shared_state)
            }
        })
        .typed_get(logout_handler)
        .typed_post(logout_handler)
        .typed_get(
            {
                let shared_state = Arc::clone(&shared_state);
                move |path, session, user| settings(path, session, user, shared_state)
            }
            .layer(RequireAuth::login_or_redirect(
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_post(
            {
                let shared_state = Arc::clone(&shared_state);
                move |path, session, auth, body| {
                    settings_POST(path, session, auth, body, shared_state)
                }
            }
            .layer(RequireAuth::login_or_redirect(
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_get(
            user_list_subscription.layer(RequireAuth::login_with_role_or_redirect(
                Role::User..,
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_post(
            {
                let shared_state = Arc::clone(&shared_state);
                move |session, path, user, body| {
                    user_list_subscription_POST(session, path, user, body, shared_state)
                }
            }
            .layer(RequireAuth::login_with_role_or_redirect(
                Role::User..,
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .layer(auth_layer)
        .layer(session_layer)
        .with_state(shared_state)
}

pub fn login_with_role_or_redirect<ResBody>( role_bounds: impl RangeBounds<Role> + Clone + Send + Sync + 'static, login_url: Arc<Cow<'static, str>>, redirect_field_name: Option<Arc<Cow<'static, str>>> ) -> RequireAuthorizationLayer<Login<UserId, User, ResBody, Role>>where ResBody: HttpBody + Default,

Authorizes requests by requiring a logged in user to have a specific range of roles, otherwise it redirects to the provided login URL.

If redirect_field_name is set to a value, the login page will receive the path it was redirected from in the URI query part. For example, attempting to visit a protected path /protected would redirect you to /login?next=/protected allowing you to know how to return the visitor to their requested page.

Examples found in repository

web/src/main.rs (lines 60-64)

fn create_app(shared_state: Arc<AppState>) -> Router {
    let store = MemoryStore::new();
    let secret = rand::thread_rng().gen::<[u8; 128]>();
    let session_layer = SessionLayer::new(store, &secret).with_secure(false);

    let auth_layer = AuthLayer::new(shared_state.clone(), &secret);

    let login_url =
        Arc::new(format!("{}{}", shared_state.root_url_prefix, LoginPath.to_crumb()).into());
    Router::new()
        .route("/", get(root))
        .typed_get(list)
        .typed_get(list_post)
        .typed_get(list_post_raw)
        .typed_get(list_topics)
        .typed_get(list_post_eml)
        .typed_get(list_edit.layer(RequireAuth::login_with_role_or_redirect(
            Role::User..,
            Arc::clone(&login_url),
            Some(Arc::new("next".into())),
        )))
        .typed_post(
            {
                let shared_state = Arc::clone(&shared_state);
                move |path, session, user, payload| {
                    list_edit_POST(path, session, user, payload, State(shared_state))
                }
            }
            .layer(RequireAuth::login_with_role_or_redirect(
                Role::User..,
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_get(
            list_subscribers.layer(RequireAuth::login_with_role_or_redirect(
                Role::User..,
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_get(
            list_candidates.layer(RequireAuth::login_with_role_or_redirect(
                Role::User..,
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_get(help)
        .typed_get(auth::ssh_signin)
        .typed_post({
            let shared_state = Arc::clone(&shared_state);
            move |path, session, query, auth, body| {
                auth::ssh_signin_POST(path, session, query, auth, body, shared_state)
            }
        })
        .typed_get(logout_handler)
        .typed_post(logout_handler)
        .typed_get(
            {
                let shared_state = Arc::clone(&shared_state);
                move |path, session, user| settings(path, session, user, shared_state)
            }
            .layer(RequireAuth::login_or_redirect(
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_post(
            {
                let shared_state = Arc::clone(&shared_state);
                move |path, session, auth, body| {
                    settings_POST(path, session, auth, body, shared_state)
                }
            }
            .layer(RequireAuth::login_or_redirect(
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_get(
            user_list_subscription.layer(RequireAuth::login_with_role_or_redirect(
                Role::User..,
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .typed_post(
            {
                let shared_state = Arc::clone(&shared_state);
                move |session, path, user, body| {
                    user_list_subscription_POST(session, path, user, body, shared_state)
                }
            }
            .layer(RequireAuth::login_with_role_or_redirect(
                Role::User..,
                Arc::clone(&login_url),
                Some(Arc::new("next".into())),
            )),
        )
        .layer(auth_layer)
        .layer(session_layer)
        .with_state(shared_state)
}