chore: normalize code

imphnen-middleware/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "imphnen-middleware"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+imphnen-iam = { version = "0.1.0", path = "../imphnen-iam" }
+imphnen-libs = { version = "0.1.0", path = "../imphnen-libs" }
+imphnen-utils = { version = "0.1.0", path = "../imphnen-utils" }
+imphnen-entities = { version = "0.1.0", path = "../imphnen-entities" }
+axum.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+utoipa.workspace = true
+lazy_static.workspace = true
+regex.workspace = true
+validator.workspace = true
+axum-test.workspace = true
+surrealdb.workspace = true
+rand.workspace = true
+tokio.workspace = true
+chrono.workspace = true
+anyhow.workspace = true
+tower-http.workspace = true
+futures.workspace = true
+tower.workspace = true
+utoipa-swagger-ui.workspace = true

imphnen-middleware/src/auth_middleware/mod.rs

@@ -0,0 +1,44 @@
+use axum::{
+	Extension, extract::Request, http::StatusCode, middleware::Next,
+	response::Response,
+};
+use imphnen_iam::{UsersItemDtoRaw, UsersRepository};
+use imphnen_libs::AppState;
+use imphnen_utils::{common_response, extract_email};
+use std::convert::Infallible;
+
+pub async fn auth_middleware(
+	Extension(state): Extension<AppState>,
+	mut req: Request,
+	next: Next,
+) -> Result<Response, Infallible> {
+	let headers = req.headers();
+	let email = match extract_email(headers) {
+		Some(email) => email,
+		None => {
+			return Ok(common_response(
+				StatusCode::UNAUTHORIZED,
+				"Invalid or expired token",
+			));
+		}
+	};
+	let repository = UsersRepository::new(&state);
+	let user: Option<UsersItemDtoRaw> =
+		match repository.query_user_by_email(email).await {
+			Ok(user) => Some(user),
+			Err(err) => {
+				return Ok(common_response(
+					StatusCode::INTERNAL_SERVER_ERROR,
+					&err.to_string(),
+				));
+			}
+		};
+	if user.is_none() {
+		return Ok(common_response(
+			StatusCode::UNAUTHORIZED,
+			"Unauthorized user",
+		));
+	}
+	req.extensions_mut().insert(user.unwrap());
+	Ok(next.run(req).await)
+}

imphnen-middleware/src/cors_middleware/mod.rs

@@ -0,0 +1,33 @@
+use axum::http::{HeaderValue, Method, header};
+use imphnen_libs::Env;
+use tower_http::cors::CorsLayer;
+
+pub fn cors_middleware() -> CorsLayer {
+	let env = Env::new();
+	let cors_origins = match env.rust_env.as_str() {
+		"development" => vec!["http://localhost:3000"],
+		"production" => {
+			vec![
+				"https://gacha.imphnen.dev",
+				"https://imphnen.dev",
+				"https://dimentorin.imphnen.dev",
+			]
+		}
+		_ => vec![
+			"http://localhost:3000",
+			"https://gacha.imphnen.dev",
+			"https://imphnen.dev",
+			"https://dimentorin.imphnen.dev",
+		],
+	};
+	let allowed_origins: Vec<HeaderValue> = cors_origins
+		.into_iter()
+		.filter_map(|origin| origin.parse::<HeaderValue>().ok())
+		.collect();
+
+	CorsLayer::new()
+		.allow_origin(allowed_origins)
+		.allow_methods([Method::GET, Method::POST, Method::PUT, Method::DELETE])
+		.allow_headers([header::AUTHORIZATION, header::CONTENT_TYPE])
+		.allow_credentials(true)
+}

imphnen-middleware/src/lib.rs

@@ -0,0 +1,7 @@
+pub mod auth_middleware;
+pub mod cors_middleware;
+pub mod permissions_middleware;
+
+pub use auth_middleware::*;
+pub use cors_middleware::*;
+pub use permissions_middleware::*;

imphnen-middleware/src/permissions_middleware/mod.rs

@@ -0,0 +1,102 @@
+use axum::{
+	body::Body,
+	http::{Request, Response, StatusCode},
+};
+use futures::future::BoxFuture;
+use imphnen_iam::{AuthRepository, PermissionsEnum};
+use imphnen_libs::AppState;
+use imphnen_utils::{common_response, extract_email};
+use std::task::{Context, Poll};
+use tower::{Layer, Service};
+
+#[derive(Clone)]
+pub struct PermissionsMiddlewareLayer {
+	app_state: AppState,
+	permissions: Vec<PermissionsEnum>,
+}
+
+impl PermissionsMiddlewareLayer {
+	pub fn new(app_state: AppState, permissions: Vec<PermissionsEnum>) -> Self {
+		Self {
+			app_state,
+			permissions,
+		}
+	}
+}
+
+impl<S> Layer<S> for PermissionsMiddlewareLayer {
+	type Service = PermissionsMiddleware<S>;
+	fn layer(&self, inner: S) -> Self::Service {
+		PermissionsMiddleware {
+			inner,
+			app_state: self.app_state.clone(),
+			permissions: self.permissions.clone(),
+		}
+	}
+}
+
+#[derive(Clone)]
+pub struct PermissionsMiddleware<S> {
+	inner: S,
+	app_state: AppState,
+	permissions: Vec<PermissionsEnum>,
+}
+
+impl<S> Service<Request<Body>> for PermissionsMiddleware<S>
+where
+	S: Service<Request<Body>, Response = Response<Body>> + Clone + Send + 'static,
+	S::Future: Send + 'static,
+{
+	type Response = S::Response;
+	type Error = S::Error;
+	type Future = BoxFuture<'static, Result<Self::Response, Self::Error>>;
+
+	fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+		self.inner.poll_ready(cx)
+	}
+
+	fn call(&mut self, req: Request<Body>) -> Self::Future {
+		let mut inner = self.inner.clone();
+		let app_state = self.app_state.clone();
+		let permissions = self.permissions.clone();
+
+		Box::pin(async move {
+			let headers = req.headers();
+			let email = match extract_email(headers) {
+				Some(email) => email,
+				None => {
+					return Ok(common_response(
+						StatusCode::UNAUTHORIZED,
+						"Invalid or missing authorization token",
+					));
+				}
+			};
+
+			let auth_repo = AuthRepository::new(&app_state);
+			let user = match auth_repo.query_get_stored_user(email).await {
+				Ok(user) => user,
+				Err(_) => {
+					return Ok(common_response(
+						StatusCode::UNAUTHORIZED,
+						"User session expired or not found",
+					));
+				}
+			};
+
+			let user_permissions: Vec<String> =
+				user.role.permissions.into_iter().map(|p| p.name).collect();
+			let allowed = permissions
+				.iter()
+				.all(|p| user_permissions.contains(&p.to_string()));
+
+			if !allowed {
+				return Ok(common_response(
+					StatusCode::FORBIDDEN,
+					"You don't have the required permissions",
+				));
+			}
+
+			inner.call(req).await
+		})
+	}
+}