Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix user extension implementation #70

Merged
merged 2 commits into from
Jun 19, 2023
Merged

Fix user extension implementation #70

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
01721de
Add an extension for the current user of type User
bngo92 May 26, 2023
8377baa
Fix user extension implementation
bngo92 Jun 18, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 82 additions & 1 deletion axum-login/src/auth.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,12 @@ where
auth_cx.current_user = user;

request.extensions_mut().insert(auth_cx.clone());
request.extensions_mut().insert(auth_cx.current_user);
request
.extensions_mut()
.insert(auth_cx.current_user.clone());
Copy link
Owner

@maxcountryman maxcountryman May 30, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the idea in keeping this to preserve backwards compatibility?

I'm a little concerned it's confusing to have Option<User> and User as extensions.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, lines 131-133 are for backwards compatibility while lines 134-136 implements the extension as described in the doc examples.

I am open to dropping lines 131-133 if you're not concerned with backwards compatibility. This change should be relatively safe as the Option<User> extension wasn't documented.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's safe to drop given we're pre-1.0.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good, I have updated the pull request.

if let Some(current_user) = auth_cx.current_user {
request.extensions_mut().insert(current_user);
}

inner.call(request).await
}
Expand Down Expand Up @@ -831,4 +836,80 @@ mod tests {
assert_eq!(res.status(), status);
}
}

#[tokio::test]
async fn user_extensions() {
let secret = rand::thread_rng().gen::<[u8; 64]>();

let store = MemoryStore::new();
let session_layer = SessionLayer::new(store, &secret);

let store = Arc::new(RwLock::new(HashMap::default()));
let user = User::get_rusty_user();
store.write().await.insert(user.get_id(), user);

let user_store = AuthMemoryStore::new(&store);
let auth_layer = AuthLayer::new(user_store, &secret);

async fn login(mut req: Request<Body>) -> Result<Response<Body>, BoxError> {
if req.uri() == "/login" {
let auth = req.extensions_mut().get_mut::<Auth>();
let user = &User::get_rusty_user();
auth.unwrap().login(user).await.unwrap();
}

if req.uri() == "/protected" {
let optional_auth_user = req.extensions().get::<Option<User>>();
let invalid_optional_auth_user = match optional_auth_user {
Some(None) => true,
Some(Some(User { .. })) => false,
None => unreachable!(),
};
let auth_user = req.extensions().get::<User>();
let invalid_auth_user = match auth_user {
None => true,
Some(User { .. }) => false,
};
match (invalid_optional_auth_user, invalid_auth_user) {
// Verify Option<User> and User extensions match
(false, false) => (),
(false, true) | (true, false) => unreachable!(),
(true, true) => {
// Emulate invalid extension by returning INTERNAL_SERVER_ERROR
return Ok(Response::builder()
.status(StatusCode::INTERNAL_SERVER_ERROR)
.body(Default::default())
.unwrap());
}
}
}

Ok(Response::new(req.into_body()))
}

let mut service = ServiceBuilder::new()
.layer(session_layer)
.layer(auth_layer)
.service_fn(login);

let request = Request::get("/protected").body(Body::empty()).unwrap();
let res = service.ready().await.unwrap().call(request).await.unwrap();
assert_eq!(res.status(), StatusCode::INTERNAL_SERVER_ERROR);

let session_cookie = res.headers().get(SET_COOKIE).unwrap().clone();

let mut request = Request::get("/login").body(Body::empty()).unwrap();
request
.headers_mut()
.insert(COOKIE, session_cookie.to_owned());
let res = service.ready().await.unwrap().call(request).await.unwrap();
assert_eq!(res.status(), StatusCode::OK);

let mut request = Request::get("/protected").body(Body::empty()).unwrap();
request
.headers_mut()
.insert(COOKIE, session_cookie.to_owned());
let res = service.ready().await.unwrap().call(request).await.unwrap();
assert_eq!(res.status(), StatusCode::OK);
}
}