access: authorization at the API

Every request is judged by the registry the node holds: store reads
pruned to what the user may read, writes refused where it may not,
admin endpoints by protocol capabilities. Without a registry, as
before (--protocol-writers for protocol data).

Auth plan M1.

1 files changed, 20 insertions, 15 deletions

diff --git a/src/api/mod.rs b/src/api/mod.rs
index e4ccee6..3e944dc 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -1,6 +1,7 @@
 //! HTTP API: router, the API description and shared response helpers (the store's
 //! own are in `store`).
 
+mod access;
 pub(crate) mod auth;
 mod changes;
 mod config;
@@ -75,21 +76,25 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) ->
         );
     }
 
-    api.layer(middleware::from_fn_with_state(auth_state, basic_auth))
-        // The hand-written spec (`docs/openapi.yaml`), and the Swagger UI showing it.
-        .merge(
-            // Relative to the UI's page (`/swagger-ui/`), so it is found behind a proxy that
-            // serves the API under a path of its own too.
-            SwaggerUi::new("/swagger-ui")
-                .config(utoipa_swagger_ui::Config::from("../openapi.yaml")),
-        )
-        .route("/openapi.yaml", get(openapi_spec))
-        .route("/health", get(health::node_health))
-        .route("/ready", get(health::ready))
-        // Outermost, so authentication failures get the error body too.
-        .layer(middleware::from_fn(json_errors))
-        .layer(middleware::from_fn(relative_redirects))
-        .with_state(state)
+    // Inside authentication, which finds the user: what the user may do.
+    api.layer(middleware::from_fn_with_state(
+        state.clone(),
+        access::authorize,
+    ))
+    .layer(middleware::from_fn_with_state(auth_state, basic_auth))
+    // The hand-written spec (`docs/openapi.yaml`), and the Swagger UI showing it.
+    .merge(
+        // Relative to the UI's page (`/swagger-ui/`), so it is found behind a proxy that
+        // serves the API under a path of its own too.
+        SwaggerUi::new("/swagger-ui").config(utoipa_swagger_ui::Config::from("../openapi.yaml")),
+    )
+    .route("/openapi.yaml", get(openapi_spec))
+    .route("/health", get(health::node_health))
+    .route("/ready", get(health::ready))
+    // Outermost, so authentication failures get the error body too.
+    .layer(middleware::from_fn(json_errors))
+    .layer(middleware::from_fn(relative_redirects))
+    .with_state(state)
 }
 
 /// The HTTP router of a node that only relays (`--relay-only`): its figures and the log