pierre/BasicOIDC
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Format code

Browse Source
This commit is contained in:
Pierre HUBERT
2022-04-03 15:50:49 +02:00
parent 9236b91f12
commit b965fa6b4f
20 changed files with 149 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
src/middlewares/auth_middleware.rs
View File

@ -1,13 +1,16 @@
//! # Authentication middleware
use std::future::{Future, ready, Ready};
use std::future::{ready, Future, Ready};
use std::pin::Pin;
use std::rc::Rc;
use actix_identity::RequestIdentity;
use actix_web::{dev::{forward_ready, Service, ServiceRequest, ServiceResponse, Transform}, Error, HttpResponse, web};
use actix_web::body::EitherBody;
use actix_web::http::{header, Method};
use actix_web::{
dev::{forward_ready, Service, ServiceRequest, ServiceResponse, Transform},
web, Error, HttpResponse,
};
use askama::Template;
use crate::constants::{ADMIN_ROUTES, AUTHENTICATED_ROUTES};
@ -25,10 +28,10 @@ pub struct AuthMiddleware;
// `S` - type of the next service
// `B` - type of response's body
impl<S, B> Transform<S, ServiceRequest> for AuthMiddleware
where
S: Service<ServiceRequest, Response=ServiceResponse<B>, Error=Error> + 'static,
S::Future: 'static,
B: 'static,
where
S: Service<ServiceRequest, Response = ServiceResponse<B>, Error = Error> + 'static,
S::Future: 'static,
B: 'static,
{
type Response = ServiceResponse<EitherBody<B>>;
type Error = Error;
@ -37,7 +40,9 @@ impl<S, B> Transform<S, ServiceRequest> for AuthMiddleware
type Future = Ready<Result<Self::Transform, Self::InitError>>;
fn new_transform(&self, service: S) -> Self::Future {
ready(Ok(AuthInnerMiddleware { service: Rc::new(service) }))
ready(Ok(AuthInnerMiddleware {
service: Rc::new(service),
}))
}
}
@ -67,16 +72,16 @@ pub struct AuthInnerMiddleware<S> {
}
impl<S, B> Service<ServiceRequest> for AuthInnerMiddleware<S>
where
S: Service<ServiceRequest, Response=ServiceResponse<B>, Error=Error> + 'static,
S::Future: 'static,
B: 'static,
where
S: Service<ServiceRequest, Response = ServiceResponse<B>, Error = Error> + 'static,
S::Future: 'static,
B: 'static,
{
type Response = ServiceResponse<EitherBody<B>>;
type Error = Error;
#[allow(clippy::type_complexity)]
type Future = Pin<Box<dyn Future<Output=Result<Self::Response, Self::Error>>>>;
type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>>>>;
forward_ready!(service);
@ -92,11 +97,14 @@ impl<S, B> Service<ServiceRequest> for AuthInnerMiddleware<S>
if req.method() == Method::POST {
if let Some(o) = origin {
if !o.to_str().unwrap_or("bad").eq(&config.website_origin) {
log::warn!("Blocked POST request from invalid origin! Origin given {:?}", o);
log::warn!(
"Blocked POST request from invalid origin! Origin given {:?}",
o
);
return Ok(req.into_response(
HttpResponse::Unauthorized()
.body("POST request from invalid origin!")
.map_into_right_body()
.map_into_right_body(),
));
}
}
@ -106,28 +114,41 @@ impl<S, B> Service<ServiceRequest> for AuthInnerMiddleware<S>
return Ok(req.into_response(
HttpResponse::Unauthorized()
.body("Hey don't touch this!")
.map_into_right_body()
.map_into_right_body(),
));
}
let session = match SessionIdentity::deserialize_session_data(req.get_identity()) {
Some(SessionIdentityData { status: SessionStatus::SignedIn, is_admin: true, .. }) => ConnStatus::Admin,
Some(SessionIdentityData { status: SessionStatus::SignedIn, .. }) => ConnStatus::RegularUser,
Some(SessionIdentityData {
status: SessionStatus::SignedIn,
is_admin: true,
..
}) => ConnStatus::Admin,
Some(SessionIdentityData {
status: SessionStatus::SignedIn,
..
}) => ConnStatus::RegularUser,
_ => ConnStatus::SignedOut,
};
// Redirect user to login page
if !session.is_auth() && (req.path().starts_with(ADMIN_ROUTES) ||
req.path().starts_with(AUTHENTICATED_ROUTES)) {
if !session.is_auth()
&& (req.path().starts_with(ADMIN_ROUTES)
|| req.path().starts_with(AUTHENTICATED_ROUTES))
{
let path = req.path().to_string();
return Ok(req.into_response(redirect_user_for_login(path))
return Ok(req
.into_response(redirect_user_for_login(path))
.map_into_right_body());
}
// Restrict access to admin pages
if !session.is_admin() && req.path().starts_with(ADMIN_ROUTES) {
return Ok(req.into_response(HttpResponse::Unauthorized()
.body(AccessDeniedTemplate {}.render().unwrap()))
return Ok(req
.into_response(
HttpResponse::Unauthorized()
.body(AccessDeniedTemplate {}.render().unwrap()),
)
.map_into_right_body());
}

2
src/middlewares/mod.rs
View File

@ -1 +1 @@
pub mod auth_middleware;
pub mod auth_middleware;