auth: logging in, and tokens as bearers

POST /auth/login (by htpasswd or the proxy), /auth/refresh,
/auth/logout, GET /auth/whoami; every request may bring
Authorization: Bearer instead of a password. --token-lifetime and
--session-lifetime.

Auth plan M2.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/api/mod.rs b/src/api/mod.rs
index 03b4fdd..b62163e 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -12,6 +12,7 @@ mod document;
 mod health;
 pub(crate) mod listen;
 mod log;
+mod login;
 mod peers;
 mod stats;
 mod store;
@@ -62,7 +63,12 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) ->
         .route("/admin/changes", get(changes::get_changes))
         .route("/admin/changes/{*key}", get(changes::get_changes_at))
         .route("/admin/config", get(config::get_config))
+        .route("/auth/login", axum::routing::post(login::login))
+        .route("/auth/refresh", axum::routing::post(login::refresh))
+        .route("/auth/logout", axum::routing::post(login::logout))
+        .route("/auth/whoami", get(login::whoami))
         .route("/admin/users", get(users::list).post(users::add_several))
+        .route("/admin/users/{name}/tokens", delete(users::revoke_tokens))
         .route(
             "/admin/users/{name}",
             get(users::get).post(users::add).delete(users::remove),
@@ -97,6 +103,8 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) ->
         access::authorize,
     ))
     .layer(middleware::from_fn_with_state(auth_state, basic_auth))
+    // Outside authentication: a token, if the request brings one, names the user.
+    .layer(middleware::from_fn_with_state(state.clone(), login::bearer))
     // The hand-written spec (`docs/openapi.yaml`), and the Swagger UI showing it.
     .merge(
         // Relative to the UI's page (`/swagger-ui/`), so it is found behind a proxy that