fad06fd
use async_trait::async_trait;
use axum::extract::{Request, State};
use axum::middleware::Next;
use axum::response::{IntoResponse, Response};
use time::OffsetDateTime;
use uuid::Uuid;
use crate::error::SessionError;
use crate::share::session::{pwd_version_matches, session_token_key};
use crate::{Session, SessionUser, SessionUserMut};
pub struct SessionWithUser {
pub user_id: Uuid,
pub is_revoked: bool,
pub expires_at: OffsetDateTime,
pub is_active: bool,
pub prohibit_login: bool,
pub is_restricted: bool,
pub passwd_version: Option<i64>,
}
#[async_trait]
pub trait SessionGuard: Send + Sync {
async fn lookup_session_with_user(
&self,
token_hash: &str,
) -> Result<Option<SessionWithUser>, SessionError>;
}
/// Default `SessionGuard::lookup_session_with_user` body shared by all services.
pub async fn lookup_session_with_user(
db: &sea_orm::DatabaseConnection,
token_hash: &str,
) -> Result<Option<SessionWithUser>, SessionError> {
use models::users::{user, user_sessions};
use sea_orm::{ColumnTrait, EntityTrait, QueryFilter};
let outcome = user_sessions::Entity::find()
.filter(user_sessions::Column::TokenHash.eq(token_hash))
.find_also_related(user::Entity)
.one(db)
.await?;
Ok(outcome.and_then(|(row, current)| {
current.map(|c| SessionWithUser {
user_id: row.user_id,
is_revoked: row.is_revoked,
expires_at: row.expires_at,
is_active: c.is_active,
prohibit_login: c.prohibit_login,
is_restricted: c.is_restricted,
passwd_version: c.passwd_version,
})
}))
}
pub async fn session_guard<S>(
State(service): State<S>,
session: Session,
request: Request,
next: Next,
) -> Response
where
S: SessionGuard,
{
let Some(uid) = session.uid() else {
return SessionError::Unauthorized.into_response();
};
let Some(token_hash) = session.get::<String>(&session_token_key(uid)) else {
return SessionError::Unauthorized.into_response();
};
let lookup = match service.lookup_session_with_user(&token_hash).await {
Ok(value) => value,
Err(error) => return error.into_response(),
};
let Some(row) = lookup else {
session.logout_user(uid);
return SessionError::Unauthorized.into_response();
};
let authorized = !row.is_revoked
&& row.user_id == uid
&& row.expires_at > OffsetDateTime::now_utc()
&& row.is_active
&& !row.prohibit_login
&& !row.is_restricted
&& pwd_version_matches(&session, row.passwd_version);
if !authorized {
session.logout_user(uid);
return SessionError::Unauthorized.into_response();
}
next.run(request).await
}