beginning implementation of authorization

dsullivan7 · dsullivan7 · commit 636ebaba6941 · 2025-01-31T16:16:27.000-05:00
diff --git a/src/authorization/mod.rs b/src/authorization/mod.rs
@@ -1,6 +1,7 @@
 use mockall::*;
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
+use uuid::Uuid;
 
 #[derive(Error, Debug)]
 pub enum AuthorizationError {
@@ -9,7 +10,7 @@ pub enum AuthorizationError {
 }
 
 pub struct User {
-    pub user_id: String,
+    pub user_id: Uuid,
     pub role: String,
 }
 
diff --git a/src/handlers/authorization.rs b/src/handlers/authorization.rs
@@ -1,19 +1,42 @@
 use anyhow::anyhow;
-use axum::{body::Body, extract::Request, extract::State, http::Response, middleware::Next};
+use axum::{
+    body::Body,
+    extract::{Request, State},
+    http::Response,
+    middleware::Next,
+    Extension,
+};
+use sea_orm::{ColumnTrait, EntityTrait, QueryFilter};
 
-use crate::{authorization::User, errors};
+use crate::{
+    authentication::Claims,
+    authorization::User as AuthzUser,
+    errors,
+    models::{self, user::Entity as User},
+};
 
 use super::AppState;
 
-pub async fn is_user_action_allowed(
-    State(AppState { authorization, .. }): State<AppState>,
+pub async fn can_list_users(
+    State(state): State<AppState>,
+    Extension(claims): Extension<Claims>,
     req: Request,
     next: Next,
 ) -> Result<Response<Body>, errors::ServerError> {
+    let conn = &*state.conn.clone();
+    let authorization = state.authorization.clone();
+
+    let user = User::find()
+        .filter(models::user::Column::Auth0Id.eq(claims.sub.to_owned()))
+        .one(conn)
+        .await
+        .map_err(|err| errors::ServerError::Internal(anyhow!(err)))?
+        .ok_or(errors::ServerError::Unauthorized)?;
+
     let is_authorized = authorization
         .is_action_allowed(
-            User {
-                user_id: "random".to_owned(),
+            AuthzUser {
+                user_id: user.user_id.to_owned(),
                 role: "random".to_owned(),
             },
             "list_users".to_owned(),
diff --git a/src/handlers/routes.rs b/src/handlers/routes.rs
@@ -32,7 +32,7 @@ pub fn router(app_state: AppState) -> Router {
                 "/users",
                 get(users::list_users).layer(middleware::from_fn_with_state(
                     app_state.clone(),
-                    authorization_middleware::is_user_action_allowed,
+                    authorization_middleware::can_list_users,
                 )),
             )
             .route("/users/{user_id}", get(users::get_user))
diff --git a/src/handlers/users_test.rs b/src/handlers/users_test.rs
@@ -93,6 +93,7 @@ mod tests {
         };
 
         let conn = MockDatabase::new(DatabaseBackend::Postgres)
+            .append_query_results(vec![vec![user_db_1.clone()]])
             .append_query_results(vec![vec![user_db_1.clone(), user_db_2.clone()]])
             .into_connection();
 

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,7 @@`
`1`	`1`	`use mockall::*;`
`2`	`2`	`use serde::{Deserialize, Serialize};`
`3`	`3`	`use thiserror::Error;`
	`4`	`+use uuid::Uuid;`
`4`	`5`
`5`	`6`	`#[derive(Error, Debug)]`
`6`	`7`	`pub enum AuthorizationError {`
`@@ -9,7 +10,7 @@ pub enum AuthorizationError {`
`9`	`10`	`}`
`10`	`11`
`11`	`12`	`pub struct User {`
`12`		`- pub user_id: String,`
	`13`	`+ pub user_id: Uuid,`
`13`	`14`	`pub role: String,`
`14`	`15`	`}`
`15`	`16`
Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,7 @@ pub fn router(app_state: AppState) -> Router {`
`32`	`32`	`"/users",`
`33`	`33`	`get(users::list_users).layer(middleware::from_fn_with_state(`
`34`	`34`	`app_state.clone(),`
`35`		`- authorization_middleware::is_user_action_allowed,`
	`35`	`+ authorization_middleware::can_list_users,`
`36`	`36`	`)),`
`37`	`37`	`)`
`38`	`38`	`.route("/users/{user_id}", get(users::get_user))`