Browse Source
Many updates
Many updates
Split codebase into modules Added custom all in one error type Added password to user model Added password hashing using bcrypt Added model validation for username using regexdevel
23 changed files with 983 additions and 417 deletions
-
350Cargo.lock
-
91Cargo.toml
-
1README.md
-
6migrations/2020-05-02-115427_create_users/up.sql
-
69src/actions.rs
-
83src/actions/users.rs
-
2src/errors.rs
-
88src/errors/domain_error.rs
-
188src/main.rs
-
3src/middlewares.rs
-
276src/middlewares/csrf.rs
-
28src/models.rs
-
13src/models/errors.rs
-
0src/models/roles.rs
-
38src/models/users.rs
-
2src/routes.rs
-
45src/routes/auth.rs
-
92src/routes/users.rs
-
2src/schema.rs
-
4src/utils.rs
-
14src/utils/auth.rs
-
5src/utils/regexs.rs
-
BINtest.db
@ -1,43 +1,70 @@ |
|||
[package] |
|||
name = "actix-demo" |
|||
version = "0.1.0" |
|||
authors = ["Rohan Sircar <rohansircar@tuta.io>"] |
|||
edition = "2018" |
|||
|
|||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html |
|||
name = 'actix-demo' |
|||
version = '0.1.0' |
|||
authors = ['Rohan Sircar <rohansircar@tuta.io>'] |
|||
edition = '2018' |
|||
|
|||
[dependencies] |
|||
actix-web = "2" |
|||
actix-rt = "1" |
|||
actix-service = "1.0.5" |
|||
actix-files = "0.2.1" |
|||
actix-web = '2' |
|||
actix-rt = '1' |
|||
actix-service = '1.0.5' |
|||
actix-files = '0.2.1' |
|||
bytes = '0.5.4' |
|||
futures = '0.3.4' |
|||
log = '0.4.8' |
|||
env_logger = '0.7' |
|||
serde_json = '1.0.52' |
|||
json = '0.12.4' |
|||
listenfd = '0.3.3' |
|||
dotenv = '0.15' |
|||
r2d2 = '0.8.8' |
|||
validator = '0.10.0' |
|||
validator_derive = '0.10' |
|||
jsonwebtoken = '7' |
|||
actix-identity = '0.2.1' |
|||
actix-web-httpauth = '0.4.1' |
|||
actix-http = '1.0.1' |
|||
rand = '0.7.3' |
|||
nanoid = '0.3.0' |
|||
bcrypt = '0.7' |
|||
timeago = '0.2.1' |
|||
comp = '0.2.1' |
|||
regex = '1.3.7' |
|||
lazy_static = '1.4.0' |
|||
lazy-regex = '0.1.2' |
|||
custom_error = '1.7.1' |
|||
|
|||
bytes = "0.5.4" |
|||
futures = "0.3.4" |
|||
log = "0.4.8" |
|||
env_logger = "0.7" |
|||
[dependencies.serde] |
|||
version = '1.0.106' |
|||
features = ['derive'] |
|||
|
|||
serde = { version = "1.0.106", features = ["derive"] } |
|||
serde_json = "1.0.52" |
|||
json = "0.12.4" |
|||
[dependencies.yarte] |
|||
version = '0.9.0' |
|||
features = ['html-min'] |
|||
|
|||
yarte = { version = "0.8.3", features = ["html-min"] } |
|||
[dependencies.diesel] |
|||
version = '1.4.4' |
|||
features = [ |
|||
'sqlite', |
|||
'r2d2', |
|||
'chrono', |
|||
] |
|||
|
|||
listenfd = "0.3.3" |
|||
[dependencies.uuid] |
|||
version = '0.8' |
|||
features = [ |
|||
'serde', |
|||
'v4', |
|||
] |
|||
|
|||
diesel = { version = "1.4.4", features = ["sqlite", "r2d2"] } |
|||
dotenv = "0.15" |
|||
r2d2 = "0.8.8" |
|||
uuid = { version = "0.8", features = ["serde", "v4"] } |
|||
validator = "0.10.0" |
|||
jsonwebtoken = "7" |
|||
actix-identity = "0.2.1" |
|||
actix-web-httpauth = "0.4.1" |
|||
actix-http = "1.0.1" |
|||
rand = "0.7.3" |
|||
nanoid = "0.3.0" |
|||
[dependencies.rusqlite] |
|||
version = '0.21.0' |
|||
features = ['bundled'] |
|||
|
|||
[dependencies.chrono] |
|||
version = '0.4.11' |
|||
features = ['serde'] |
|||
[build-dependencies.yarte_helpers] |
|||
version = "0.8" |
|||
version = '0.9.0' |
|||
default-features = false |
|||
features = ["config"] |
|||
features = ['config'] |
|||
@ -0,0 +1 @@ |
|||
Testing out the Rust framework Actix-Web to create a JSON API CRUD Web App. |
|||
@ -1,5 +1,7 @@ |
|||
-- Your SQL goes here |
|||
CREATE TABLE users ( |
|||
id INTEGER NOT NULL PRIMARY KEY, |
|||
name VARCHAR NOT NULL |
|||
id INTEGER PRIMARY KEY NOT NULL , |
|||
name VARCHAR NOT NULL, |
|||
password VARCHAR NOT NULL, |
|||
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP |
|||
) |
|||
@ -1,67 +1,2 @@ |
|||
use diesel::prelude::*;
|
|||
|
|||
use crate::models;
|
|||
|
|||
pub fn find_user_by_uid(
|
|||
uid: i32,
|
|||
conn: &SqliteConnection,
|
|||
) -> Result<Option<models::User>, diesel::result::Error> {
|
|||
use crate::schema::users::dsl::*;
|
|||
|
|||
let maybe_user = users.find(uid).first::<models::User>(conn).optional();
|
|||
|
|||
// Ok(user)
|
|||
maybe_user
|
|||
}
|
|||
|
|||
pub fn find_user_by_name(
|
|||
user_name: String,
|
|||
conn: &SqliteConnection,
|
|||
) -> Result<Option<models::User>, diesel::result::Error> {
|
|||
use crate::schema::users::dsl::*;
|
|||
|
|||
let maybe_user = users
|
|||
.filter(name.eq(user_name))
|
|||
.first::<models::User>(conn)
|
|||
.optional();
|
|||
|
|||
maybe_user
|
|||
}
|
|||
|
|||
pub fn get_all(
|
|||
conn: &SqliteConnection,
|
|||
) -> Result<Option<Vec<models::User>>, diesel::result::Error> {
|
|||
use crate::schema::users::dsl::*;
|
|||
users.load::<models::User>(conn).optional()
|
|||
}
|
|||
|
|||
/// Run query using Diesel to insert a new database row and return the result.
|
|||
pub fn insert_new_user(
|
|||
nu: &models::NewUser,
|
|||
conn: &SqliteConnection,
|
|||
) -> Result<models::User, diesel::result::Error> {
|
|||
// It is common when using Diesel with Actix web to import schema-related
|
|||
// modules inside a function's scope (rather than the normal module's scope)
|
|||
// to prevent import collisions and namespace pollution.
|
|||
use crate::schema::users::dsl::*;
|
|||
|
|||
// let new_user = models::User {
|
|||
// id: Uuid::new_v4().to_string(),
|
|||
// name: nu.name.to_string(),
|
|||
// };
|
|||
|
|||
// let x = users.load::<models::User>(conn).optional();
|
|||
// let target = users.find("4");
|
|||
// let test_user = models::User {
|
|||
// id: "5".to_owned(),
|
|||
// name: "who".to_owned(),
|
|||
// };
|
|||
// let update_result = diesel::update(target).set(&test_user).execute(conn);
|
|||
|
|||
diesel::insert_into(users).values(nu).execute(conn)?;
|
|||
let user = users
|
|||
.filter(name.eq(nu.name.clone()))
|
|||
.first::<models::User>(conn);
|
|||
user
|
|||
// Ok(nu.clone())
|
|||
}
|
|||
pub mod users;
|
|||
pub use self::users::*;
|
|||
@ -0,0 +1,83 @@ |
|||
use diesel::prelude::*;
|
|||
|
|||
use crate::errors;
|
|||
use crate::models;
|
|||
use bcrypt::{hash, DEFAULT_COST};
|
|||
use std::rc::Rc;
|
|||
|
|||
pub fn find_user_by_uid(
|
|||
uid: i32,
|
|||
conn: &SqliteConnection,
|
|||
) -> Result<Option<models::UserDTO>, errors::DomainError> {
|
|||
use crate::schema::users::dsl::*;
|
|||
|
|||
let maybe_user = users
|
|||
.select((name, created_at))
|
|||
.find(uid)
|
|||
.first::<models::UserDTO>(conn)
|
|||
.optional();
|
|||
|
|||
Ok(maybe_user?)
|
|||
}
|
|||
|
|||
pub fn _find_user_by_name(
|
|||
user_name: String,
|
|||
conn: &SqliteConnection,
|
|||
) -> Result<Option<models::UserDTO>, errors::DomainError> {
|
|||
use crate::schema::users::dsl::*;
|
|||
|
|||
let maybe_user = users
|
|||
.select((name, created_at))
|
|||
.filter(name.eq(user_name))
|
|||
.first::<models::UserDTO>(conn)
|
|||
.optional();
|
|||
|
|||
Ok(maybe_user?)
|
|||
}
|
|||
|
|||
pub fn get_all(
|
|||
conn: &SqliteConnection,
|
|||
) -> Result<Option<Vec<models::UserDTO>>, errors::DomainError> {
|
|||
use crate::schema::users::dsl::*;
|
|||
Ok(users
|
|||
.select((name, created_at))
|
|||
.load::<models::UserDTO>(conn)
|
|||
.optional()?)
|
|||
}
|
|||
|
|||
/// Run query using Diesel to insert a new database row and return the result.
|
|||
pub fn insert_new_user(
|
|||
mut nu: Rc<models::NewUser>,
|
|||
conn: &SqliteConnection,
|
|||
) -> Result<models::UserDTO, errors::DomainError> {
|
|||
// It is common when using Diesel with Actix web to import schema-related
|
|||
// modules inside a function's scope (rather than the normal module's scope)
|
|||
// to prevent import collisions and namespace pollution.
|
|||
use crate::schema::users::dsl::*;
|
|||
|
|||
// let new_user = models::User {
|
|||
// id: Uuid::new_v4().to_string(),
|
|||
// name: nu.name.to_string(),
|
|||
// };
|
|||
|
|||
// let x = users.load::<models::User>(conn).optional();
|
|||
// let target = users.find("4");
|
|||
// let test_user = models::User {
|
|||
// id: "5".to_owned(),
|
|||
// name: "who".to_owned(),
|
|||
// };
|
|||
// let update_result = diesel::update(target).set(&test_user).execute(conn);
|
|||
|
|||
// let mut nu2 = nu.clone();
|
|||
let mut nu2 = Rc::make_mut(&mut nu);
|
|||
nu2.password = hash(nu2.password.clone(), DEFAULT_COST)?;
|
|||
|
|||
diesel::insert_into(users)
|
|||
.values(nu.as_ref())
|
|||
.execute(conn)?;
|
|||
let user = users
|
|||
.select((name, created_at))
|
|||
.filter(name.eq(nu.name.clone()))
|
|||
.first::<models::UserDTO>(conn);
|
|||
Ok(user?)
|
|||
}
|
|||
@ -0,0 +1,2 @@ |
|||
pub mod domain_error;
|
|||
pub use self::domain_error::*;
|
|||
@ -0,0 +1,88 @@ |
|||
use actix_web::{HttpResponse, ResponseError};
|
|||
use bcrypt::BcryptError;
|
|||
use custom_error::custom_error;
|
|||
// use derive_more::Display;
|
|||
// use diesel::result::DatabaseErrorKind;
|
|||
use crate::models::errors::*;
|
|||
use r2d2;
|
|||
use std::convert::From;
|
|||
// use std::error::Error;
|
|||
|
|||
// pub enum DomainError {
|
|||
// #[display(fmt = "PasswordHashError")]
|
|||
// PwdHashError,
|
|||
// #[display(fmt = "Bad Id")]
|
|||
// IdError,
|
|||
// #[display(fmt = "Generic Error")]
|
|||
// GenericError,
|
|||
// DuplicateValue,
|
|||
// }
|
|||
|
|||
// impl Error for DomainError {
|
|||
// fn source(&self) -> Option<&(dyn error::Error + 'static)> {
|
|||
// // Generic error, underlying cause isn't tracked.
|
|||
// None
|
|||
// }
|
|||
// }
|
|||
|
|||
// impl From<DBError> for DomainError {
|
|||
// fn from(error: DBError) -> DomainError {
|
|||
// // We only care about UniqueViolations
|
|||
// match error {
|
|||
// DBError::DatabaseError(kind, info) => {
|
|||
// let message = info.details().unwrap_or_else(|| info.message()).to_string();
|
|||
// match kind {
|
|||
// DatabaseErrorKind::UniqueViolation => DomainError::DuplicateValue(message),
|
|||
// _ => DomainError::GenericError(message),
|
|||
// }
|
|||
// }
|
|||
// _ => DomainError::GenericError(String::from("Some database error occured")),
|
|||
// }
|
|||
// }
|
|||
// }
|
|||
|
|||
custom_error! { pub DomainError
|
|||
PwdHashError {source: BcryptError} = "Failed to has password",
|
|||
DbError {source: diesel::result::Error} = "Database error",
|
|||
DbPoolError {source: r2d2::Error} = "Failed to get connection from pool",
|
|||
GenericError {cause: String} = "Generic Error - Reason: {cause}"
|
|||
}
|
|||
|
|||
impl ResponseError for DomainError {
|
|||
fn error_response(&self) -> HttpResponse {
|
|||
match self {
|
|||
DomainError::PwdHashError { source } => {
|
|||
HttpResponse::InternalServerError().json(ErrorModel {
|
|||
status_code: 500,
|
|||
reason: format!(
|
|||
"{} {}",
|
|||
"Unexpected Error - Failed to hash password", source
|
|||
),
|
|||
})
|
|||
}
|
|||
DomainError::DbError { source } => {
|
|||
HttpResponse::InternalServerError().json(ErrorModel {
|
|||
status_code: 500,
|
|||
reason: format!("{} {}", "Unexpected Database Error", source),
|
|||
})
|
|||
}
|
|||
DomainError::DbPoolError { source } => {
|
|||
HttpResponse::InternalServerError().json(ErrorModel {
|
|||
status_code: 500,
|
|||
reason: format!(
|
|||
"{} {}",
|
|||
"Unexpected Error - Failed to get connection from pool", source
|
|||
),
|
|||
})
|
|||
}
|
|||
DomainError::GenericError { cause } => HttpResponse::BadRequest().json(ErrorModel {
|
|||
status_code: 400,
|
|||
reason: format!(
|
|||
"{} {}, ",
|
|||
"Unexpected Database Error - ".to_owned(),
|
|||
cause.clone()
|
|||
),
|
|||
}),
|
|||
}
|
|||
}
|
|||
}
|
|||
@ -0,0 +1,3 @@ |
|||
pub mod csrf;
|
|||
|
|||
pub use self::csrf::*;
|
|||
@ -0,0 +1,276 @@ |
|||
// //! A filter for cross-site request forgery (CSRF).
|
|||
// //!
|
|||
// //! This middleware is stateless and [based on request
|
|||
// //! headers](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Verifying_Same_Origin_with_Standard_Headers).
|
|||
// //!
|
|||
// //! By default requests are allowed only if one of these is true:
|
|||
// //!
|
|||
// //! * The request method is safe (`GET`, `HEAD`, `OPTIONS`). It is the
|
|||
// //! applications responsibility to ensure these methods cannot be used to
|
|||
// //! execute unwanted actions. Note that upgrade requests for websockets are
|
|||
// //! also considered safe.
|
|||
// //! * The `Origin` header (added automatically by the browser) matches one
|
|||
// //! of the allowed origins.
|
|||
// //! * There is no `Origin` header but the `Referer` header matches one of
|
|||
// //! the allowed origins.
|
|||
// //!
|
|||
// //! Use [`CsrfFilter::allow_xhr()`](struct.CsrfFilter.html#method.allow_xhr)
|
|||
// //! if you want to allow requests with unprotected methods via
|
|||
// //! [CORS](../cors/struct.Cors.html).
|
|||
// //!
|
|||
// //! # Example
|
|||
// //!
|
|||
// //! ```
|
|||
// //! # extern crate actix_web;
|
|||
// //! use actix_web::middleware::csrf;
|
|||
// //! use actix_web::{http, App, HttpRequest, HttpResponse};
|
|||
// //!
|
|||
// //! fn handle_post(_: &HttpRequest) -> &'static str {
|
|||
// //! "This action should only be triggered with requests from the same site"
|
|||
// //! }
|
|||
// //!
|
|||
// //! fn main() {
|
|||
// //! let app = App::new()
|
|||
// //! .middleware(
|
|||
// //! csrf::CsrfFilter::new().allowed_origin("https://www.example.com"),
|
|||
// //! )
|
|||
// //! .resource("/", |r| {
|
|||
// //! r.method(http::Method::GET).f(|_| HttpResponse::Ok());
|
|||
// //! r.method(http::Method::POST).f(handle_post);
|
|||
// //! })
|
|||
// //! .finish();
|
|||
// //! }
|
|||
// //! ```
|
|||
// //!
|
|||
// //! In this example the entire application is protected from CSRF.
|
|||
|
|||
// use std::borrow::Cow;
|
|||
// use std::collections::HashSet;
|
|||
|
|||
// use bytes::Bytes;
|
|||
// use error::{ResponseError, Result};
|
|||
// use http::{header, HeaderMap, HttpTryFrom, Uri};
|
|||
// use httprequest::HttpRequest;
|
|||
// use httpresponse::HttpResponse;
|
|||
// use middleware::{Middleware, Started};
|
|||
// use server::Request;
|
|||
|
|||
// /// Potential cross-site request forgery detected.
|
|||
// #[derive(Debug, Fail)]
|
|||
// pub enum CsrfError {
|
|||
// /// The HTTP request header `Origin` was required but not provided.
|
|||
// #[fail(display = "Origin header required")]
|
|||
// MissingOrigin,
|
|||
// /// The HTTP request header `Origin` could not be parsed correctly.
|
|||
// #[fail(display = "Could not parse Origin header")]
|
|||
// BadOrigin,
|
|||
// /// The cross-site request was denied.
|
|||
// #[fail(display = "Cross-site request denied")]
|
|||
// CsrDenied,
|
|||
// }
|
|||
|
|||
// impl ResponseError for CsrfError {
|
|||
// fn error_response(&self) -> HttpResponse {
|
|||
// HttpResponse::Forbidden().body(self.to_string())
|
|||
// }
|
|||
// }
|
|||
|
|||
// fn uri_origin(uri: &Uri) -> Option<String> {
|
|||
// match (
|
|||
// uri.scheme_part(),
|
|||
// uri.host(),
|
|||
// uri.port_part().map(|port| port.as_u16()),
|
|||
// ) {
|
|||
// (Some(scheme), Some(host), Some(port)) => Some(format!("{}://{}:{}", scheme, host, port)),
|
|||
// (Some(scheme), Some(host), None) => Some(format!("{}://{}", scheme, host)),
|
|||
// _ => None,
|
|||
// }
|
|||
// }
|
|||
|
|||
// fn origin(headers: &HeaderMap) -> Option<Result<Cow<str>, CsrfError>> {
|
|||
// headers
|
|||
// .get(header::ORIGIN)
|
|||
// .map(|origin| {
|
|||
// origin
|
|||
// .to_str()
|
|||
// .map_err(|_| CsrfError::BadOrigin)
|
|||
// .map(|o| o.into())
|
|||
// })
|
|||
// .or_else(|| {
|
|||
// headers.get(header::REFERER).map(|referer| {
|
|||
// Uri::try_from(Bytes::from(referer.as_bytes()))
|
|||
// .ok()
|
|||
// .as_ref()
|
|||
// .and_then(uri_origin)
|
|||
// .ok_or(CsrfError::BadOrigin)
|
|||
// .map(|o| o.into())
|
|||
// })
|
|||
// })
|
|||
// }
|
|||
|
|||
// /// A middleware that filters cross-site requests.
|
|||
// ///
|
|||
// /// To construct a CSRF filter:
|
|||
// ///
|
|||
// /// 1. Call [`CsrfFilter::build`](struct.CsrfFilter.html#method.build) to
|
|||
// /// start building.
|
|||
// /// 2. [Add](struct.CsrfFilterBuilder.html#method.allowed_origin) allowed
|
|||
// /// origins.
|
|||
// /// 3. Call [finish](struct.CsrfFilterBuilder.html#method.finish) to retrieve
|
|||
// /// the constructed filter.
|
|||
// ///
|
|||
// /// # Example
|
|||
// ///
|
|||
// /// ```
|
|||
// /// use actix_web::middleware::csrf;
|
|||
// /// use actix_web::App;
|
|||
// ///
|
|||
// /// # fn main() {
|
|||
// /// let app = App::new()
|
|||
// /// .middleware(csrf::CsrfFilter::new().allowed_origin("https://www.example.com"));
|
|||
// /// # }
|
|||
// /// ```
|
|||
// #[derive(Default)]
|
|||
// pub struct CsrfFilter {
|
|||
// origins: HashSet<String>,
|
|||
// allow_xhr: bool,
|
|||
// allow_missing_origin: bool,
|
|||
// allow_upgrade: bool,
|
|||
// }
|
|||
|
|||
// impl CsrfFilter {
|
|||
// /// Start building a `CsrfFilter`.
|
|||
// pub fn new() -> CsrfFilter {
|
|||
// CsrfFilter {
|
|||
// origins: HashSet::new(),
|
|||
// allow_xhr: false,
|
|||
// allow_missing_origin: false,
|
|||
// allow_upgrade: false,
|
|||
// }
|
|||
// }
|
|||
|
|||
// /// Add an origin that is allowed to make requests. Will be verified
|
|||
// /// against the `Origin` request header.
|
|||
// pub fn allowed_origin<T: Into<String>>(mut self, origin: T) -> CsrfFilter {
|
|||
// self.origins.insert(origin.into());
|
|||
// self
|
|||
// }
|
|||
|
|||
// /// Allow all requests with an `X-Requested-With` header.
|
|||
// ///
|
|||
// /// A cross-site attacker should not be able to send requests with custom
|
|||
// /// headers unless a CORS policy whitelists them. Therefore it should be
|
|||
// /// safe to allow requests with an `X-Requested-With` header (added
|
|||
// /// automatically by many JavaScript libraries).
|
|||
// ///
|
|||
// /// This is disabled by default, because in Safari it is possible to
|
|||
// /// circumvent this using redirects and Flash.
|
|||
// ///
|
|||
// /// Use this method to enable more lax filtering.
|
|||
// pub fn allow_xhr(mut self) -> CsrfFilter {
|
|||
// self.allow_xhr = true;
|
|||
// self
|
|||
// }
|
|||
|
|||
// /// Allow requests if the expected `Origin` header is missing (and
|
|||
// /// there is no `Referer` to fall back on).
|
|||
// ///
|
|||
// /// The filter is conservative by default, but it should be safe to allow
|
|||
// /// missing `Origin` headers because a cross-site attacker cannot prevent
|
|||
// /// the browser from sending `Origin` on unprotected requests.
|
|||
// pub fn allow_missing_origin(mut self) -> CsrfFilter {
|
|||
// self.allow_missing_origin = true;
|
|||
// self
|
|||
// }
|
|||
|
|||
// /// Allow cross-site upgrade requests (for example to open a WebSocket).
|
|||
// pub fn allow_upgrade(mut self) -> CsrfFilter {
|
|||
// self.allow_upgrade = true;
|
|||
// self
|
|||
// }
|
|||
|
|||
// fn validate(&self, req: &Request) -> Result<(), CsrfError> {
|
|||
// let is_upgrade = req.headers().contains_key(header::UPGRADE);
|
|||
// let is_safe = req.method().is_safe() && (self.allow_upgrade || !is_upgrade);
|
|||
|
|||
// if is_safe || (self.allow_xhr && req.headers().contains_key("x-requested-with")) {
|
|||
// Ok(())
|
|||
// } else if let Some(header) = origin(req.headers()) {
|
|||
// match header {
|
|||
// Ok(ref origin) if self.origins.contains(origin.as_ref()) => Ok(()),
|
|||
// Ok(_) => Err(CsrfError::CsrDenied),
|
|||
// Err(err) => Err(err),
|
|||
// }
|
|||
// } else if self.allow_missing_origin {
|
|||
// Ok(())
|
|||
// } else {
|
|||
// Err(CsrfError::MissingOrigin)
|
|||
// }
|
|||
// }
|
|||
// }
|
|||
|
|||
// impl<S> Middleware<S> for CsrfFilter {
|
|||
// fn start(&self, req: &HttpRequest<S>) -> Result<Started> {
|
|||
// self.validate(req)?;
|
|||
// Ok(Started::Done)
|
|||
// }
|
|||
// }
|
|||
|
|||
// #[cfg(test)]
|
|||
// mod tests {
|
|||
// use super::*;
|
|||
// use http::Method;
|
|||
// use test::TestRequest;
|
|||
|
|||
// #[test]
|
|||
// fn test_safe() {
|
|||
// let csrf = CsrfFilter::new().allowed_origin("https://www.example.com");
|
|||
|
|||
// let req = TestRequest::with_header("Origin", "https://www.w3.org")
|
|||
// .method(Method::HEAD)
|
|||
// .finish();
|
|||
|
|||
// assert!(csrf.start(&req).is_ok());
|
|||
// }
|
|||
|
|||
// #[test]
|
|||
// fn test_csrf() {
|
|||
// let csrf = CsrfFilter::new().allowed_origin("https://www.example.com");
|
|||
|
|||
// let req = TestRequest::with_header("Origin", "https://www.w3.org")
|
|||
// .method(Method::POST)
|
|||
// .finish();
|
|||
|
|||
// assert!(csrf.start(&req).is_err());
|
|||
// }
|
|||
|
|||
// #[test]
|
|||
// fn test_referer() {
|
|||
// let csrf = CsrfFilter::new().allowed_origin("https://www.example.com");
|
|||
|
|||
// let req =
|
|||
// TestRequest::with_header("Referer", "https://www.example.com/some/path?query=param")
|
|||
// .method(Method::POST)
|
|||
// .finish();
|
|||
|
|||
// assert!(csrf.start(&req).is_ok());
|
|||
// }
|
|||
|
|||
// #[test]
|
|||
// fn test_upgrade() {
|
|||
// let strict_csrf = CsrfFilter::new().allowed_origin("https://www.example.com");
|
|||
|
|||
// let lax_csrf = CsrfFilter::new()
|
|||
// .allowed_origin("https://www.example.com")
|
|||
// .allow_upgrade();
|
|||
|
|||
// let req = TestRequest::with_header("Origin", "https://cswsh.com")
|
|||
// .header("Connection", "Upgrade")
|
|||
// .header("Upgrade", "websocket")
|
|||
// .method(Method::GET)
|
|||
// .finish();
|
|||
|
|||
// assert!(strict_csrf.start(&req).is_err());
|
|||
// assert!(lax_csrf.start(&req).is_ok());
|
|||
// }
|
|||
// }
|
|||
@ -1,24 +1,4 @@ |
|||
use serde::{Deserialize, Serialize};
|
|||
|
|||
use crate::schema::users;
|
|||
use yarte::Template;
|
|||
|
|||
#[derive(Debug, Clone, Serialize, Queryable, Identifiable, Deserialize)]
|
|||
pub struct User {
|
|||
pub id: i32,
|
|||
pub name: String,
|
|||
}
|
|||
|
|||
#[derive(Debug, Clone, Serialize, Insertable, Deserialize)]
|
|||
#[table_name = "users"]
|
|||
pub struct NewUser {
|
|||
pub name: String,
|
|||
}
|
|||
|
|||
#[derive(Template)]
|
|||
#[template(path = "hello.hbs")]
|
|||
pub struct CardTemplate<'a> {
|
|||
pub title: &'a str,
|
|||
pub body: String,
|
|||
pub num: u32,
|
|||
}
|
|||
pub mod users;
|
|||
pub use self::users::*;
|
|||
pub mod errors;
|
|||
pub use self::errors::*;
|
|||
@ -0,0 +1,13 @@ |
|||
use serde::Serialize;
|
|||
|
|||
#[derive(Debug, Clone, Serialize)]
|
|||
pub struct JsonErrorModel {
|
|||
status_code: i16,
|
|||
pub line: String,
|
|||
pub reason: String,
|
|||
}
|
|||
#[derive(Debug, Clone, Serialize)]
|
|||
pub struct ErrorModel {
|
|||
pub status_code: i16,
|
|||
pub reason: String,
|
|||
}
|
|||
@ -0,0 +1,38 @@ |
|||
use serde::{Deserialize, Serialize};
|
|||
|
|||
use crate::schema::users;
|
|||
use crate::utils::regexs;
|
|||
use chrono;
|
|||
use validator::Validate;
|
|||
use validator_derive::*;
|
|||
use yarte::Template;
|
|||
|
|||
#[derive(Debug, Clone, Serialize, Queryable, Identifiable, Deserialize, PartialEq)]
|
|||
pub struct User {
|
|||
pub id: i32,
|
|||
pub name: String,
|
|||
pub password: String,
|
|||
pub created_at: chrono::NaiveDateTime,
|
|||
}
|
|||
|
|||
#[derive(Debug, Clone, Serialize, Insertable, Deserialize, Validate)]
|
|||
#[table_name = "users"]
|
|||
pub struct NewUser {
|
|||
#[validate(regex = "regexs::USERNAME_REG", length(min = 4, max = 10))]
|
|||
pub name: String,
|
|||
pub password: String,
|
|||
}
|
|||
|
|||
#[derive(Debug, Clone, Serialize, Deserialize, Queryable)]
|
|||
pub struct UserDTO {
|
|||
pub name: String,
|
|||
pub registration_date: chrono::NaiveDateTime,
|
|||
}
|
|||
|
|||
#[derive(Template)]
|
|||
#[template(path = "hello.hbs")]
|
|||
pub struct CardTemplate<'a> {
|
|||
pub title: &'a str,
|
|||
pub body: String,
|
|||
pub num: u32,
|
|||
}
|
|||
@ -1,2 +1,4 @@ |
|||
pub mod auth;
|
|||
pub mod users;
|
|||
pub use self::auth::*;
|
|||
pub use self::users::*;
|
|||
@ -0,0 +1,45 @@ |
|||
use actix_web_httpauth::extractors::basic::BasicAuth;
|
|||
|
|||
use actix_identity::Identity;
|
|||
use actix_web::{get, post, Error, HttpResponse};
|
|||
|
|||
#[get("/login")]
|
|||
pub async fn login(id: Identity, credentials: BasicAuth) -> Result<HttpResponse, Error> {
|
|||
let maybe_identity = id.identity();
|
|||
let response = if let Some(identity) = maybe_identity {
|
|||
HttpResponse::Found()
|
|||
.header("location", "/")
|
|||
.content_type("text/plain")
|
|||
.json(format!("Already logged in as {}", identity))
|
|||
} else {
|
|||
id.remember(credentials.user_id().to_string());
|
|||
HttpResponse::Found().header("location", "/").finish()
|
|||
};
|
|||
println!("{}", credentials.user_id());
|
|||
println!("{:?}", credentials.password());
|
|||
Ok(response)
|
|||
}
|
|||
|
|||
#[get("/logout")]
|
|||
pub async fn logout(id: Identity, _credentials: BasicAuth) -> Result<HttpResponse, Error> {
|
|||
let maybe_identity = id.identity();
|
|||
let response = if let Some(identity) = maybe_identity {
|
|||
info!("Logging out {user}", user = identity);
|
|||
id.forget();
|
|||
HttpResponse::Found().header("location", "/").finish()
|
|||
} else {
|
|||
HttpResponse::Found()
|
|||
.header("location", "/")
|
|||
.content_type("text/plain")
|
|||
.json("Not logged in")
|
|||
};
|
|||
Ok(response)
|
|||
}
|
|||
|
|||
#[get("/")]
|
|||
pub async fn index(id: Identity) -> String {
|
|||
format!(
|
|||
"Hello {}",
|
|||
id.identity().unwrap_or_else(|| "Anonymous".to_owned())
|
|||
)
|
|||
}
|
|||
@ -1,76 +1,82 @@ |
|||
use actix_web::{get, post, web, Error, HttpResponse};
|
|||
use actix_web::{get, post, web, HttpResponse};
|
|||
|
|||
use crate::actions;
|
|||
use crate::models;
|
|||
use crate::types::DbPool;
|
|||
use actix_web::error::ResponseError;
|
|||
use std::rc::Rc;
|
|||
|
|||
/// Finds user by UID.
|
|||
#[get("/api/authzd/users/get/{user_id}")]
|
|||
pub async fn get_user(
|
|||
pool: web::Data<DbPool>,
|
|||
user_uid: web::Path<i32>,
|
|||
) -> Result<HttpResponse, Error> {
|
|||
) -> Result<HttpResponse, impl ResponseError> {
|
|||
let user_uid = user_uid.into_inner();
|
|||
// use web::block to offload blocking Diesel code without blocking server thread
|
|||
let maybe_user = web::block(move || {
|
|||
let conn = pool.get().map_err(|e| e.to_string())?;
|
|||
actions::find_user_by_uid(user_uid.into(), &conn).map_err(|e| e.to_string())
|
|||
let res = web::block(move || {
|
|||
let conn = pool.get()?;
|
|||
actions::find_user_by_uid(user_uid, &conn)
|
|||
})
|
|||
.await
|
|||
.map_err(|e| {
|
|||
error!("{}", e);
|
|||
HttpResponse::InternalServerError().finish()
|
|||
})?;
|
|||
|
|||
if let Some(user) = maybe_user {
|
|||
Ok(HttpResponse::Ok().json(user))
|
|||
} else {
|
|||
let res = HttpResponse::NotFound().body(format!("No user found with uid: {}", user_uid));
|
|||
Ok(res)
|
|||
}
|
|||
.and_then(|maybe_user| {
|
|||
if let Some(user) = maybe_user {
|
|||
Ok(HttpResponse::Ok().json(user))
|
|||
} else {
|
|||
let res =
|
|||
HttpResponse::NotFound().body(format!("No user found with uid: {}", user_uid));
|
|||
Ok(res)
|
|||
}
|
|||
});
|
|||
res
|
|||
}
|
|||
|
|||
#[get("/api/authzd/users/get")]
|
|||
pub async fn get_all_users(pool: web::Data<DbPool>) -> Result<HttpResponse, Error> {
|
|||
pub async fn get_all_users(pool: web::Data<DbPool>) -> Result<HttpResponse, impl ResponseError> {
|
|||
// use web::block to offload blocking Diesel code without blocking server thread
|
|||
let maybe_users = web::block(move || {
|
|||
let conn = pool.get().map_err(|e| e.to_string())?;
|
|||
actions::get_all(&conn).map_err(|e| e.to_string())
|
|||
let res = web::block(move || {
|
|||
let conn = pool.get()?;
|
|||
actions::get_all(&conn)
|
|||
})
|
|||
.await
|
|||
.map_err(|e| {
|
|||
eprintln!("{}", e);
|
|||
HttpResponse::InternalServerError().finish()
|
|||
})?;
|
|||
|
|||
if let Some(users) = maybe_users {
|
|||
Ok(HttpResponse::Ok().json(users))
|
|||
} else {
|
|||
let res = HttpResponse::NotFound().body(format!("No users available"));
|
|||
Ok(res)
|
|||
}
|
|||
// Ok(HttpResponse::Ok().json(users))
|
|||
.and_then(|maybe_users| {
|
|||
debug!("{:?}", maybe_users);
|
|||
if let Some(users) = maybe_users {
|
|||
if users.is_empty() {
|
|||
let res = HttpResponse::Ok().json(models::ErrorModel {
|
|||
status_code: 200,
|
|||
reason: "No users available".to_string(),
|
|||
});
|
|||
Ok(res)
|
|||
} else {
|
|||
Ok(HttpResponse::Ok().json(users))
|
|||
}
|
|||
} else {
|
|||
let res = HttpResponse::Ok().json(models::ErrorModel {
|
|||
status_code: 200,
|
|||
reason: "No users available".to_string(),
|
|||
});
|
|||
Ok(res)
|
|||
}
|
|||
});
|
|||
res
|
|||
}
|
|||
|
|||
/// Inserts new user with name defined in form.
|
|||
#[post("/api/authzd/users/post")]
|
|||
#[post("/do_registration")]
|
|||
pub async fn add_user(
|
|||
pool: web::Data<DbPool>,
|
|||
form: web::Json<models::NewUser>,
|
|||
) -> Result<HttpResponse, Error> {
|
|||
) -> Result<HttpResponse, impl ResponseError> {
|
|||
// use web::block to offload blocking Diesel code without blocking server thread
|
|||
let user = web::block(move || {
|
|||
let conn = pool.get().map_err(|e| e.to_string())?;
|
|||
actions::insert_new_user(&form, &conn).map_err(|e| e.to_string())
|
|||
let conn = pool.get()?;
|
|||
actions::insert_new_user(Rc::new(form.0), &conn)
|
|||
})
|
|||
.await
|
|||
.map(|user| {
|
|||
.and_then(|user| {
|
|||
debug!("{:?}", user);
|
|||
Ok(HttpResponse::Ok().json(user))
|
|||
})
|
|||
.map_err(|e| {
|
|||
eprintln!("{}", e);
|
|||
HttpResponse::InternalServerError().finish()
|
|||
})?;
|
|||
Ok(HttpResponse::Created().json(user))
|
|||
});
|
|||
user
|
|||
}
|
|||
@ -0,0 +1,4 @@ |
|||
pub mod auth;
|
|||
pub mod regexs;
|
|||
pub use self::auth::*;
|
|||
pub use self::regexs::*;
|
|||
@ -0,0 +1,14 @@ |
|||
use actix_web_httpauth::extractors::basic::BasicAuth;
|
|||
|
|||
// use actix_identity::Identity;
|
|||
use actix_web::{dev::ServiceRequest, Error};
|
|||
|
|||
pub async fn validator(
|
|||
req: ServiceRequest,
|
|||
credentials: BasicAuth,
|
|||
) -> Result<ServiceRequest, Error> {
|
|||
println!("{}", credentials.user_id());
|
|||
println!("{:?}", credentials.password());
|
|||
// verify credentials from db
|
|||
Ok(req)
|
|||
}
|
|||
@ -0,0 +1,5 @@ |
|||
use lazy_static::lazy_static;
|
|||
use regex::Regex;
|
|||
lazy_static! {
|
|||
pub static ref USERNAME_REG: Regex = Regex::new(r"^([a-z\d]+-)*[a-z\d]+$").unwrap();
|
|||
}
|
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue