1 files changed, 18 insertions, 13 deletions
diff --git a/src/api/auth.rs b/src/api/auth.rs
index 3926c70..de4220c 100644
--- a/src/api/auth.rs
+++ b/src/api/auth.rs
@@ -1,14 +1,14 @@
-use argon2::{password_hash::PasswordVerifier, Argon2};
+use argon2::{Argon2, password_hash::PasswordVerifier};
 use axum::extract::State;
 use axum::{
     body::Body,
     http::{
-        header::{AUTHORIZATION, WWW_AUTHENTICATE},
         HeaderMap, Request, StatusCode,
+        header::{AUTHORIZATION, WWW_AUTHENTICATE},
     },
     response::{IntoResponse, Response},
 };
-use base64::{engine::general_purpose::STANDARD as BASE64, Engine};
+use base64::{Engine, engine::general_purpose::STANDARD as BASE64};
 use dashmap::DashMap;
 use password_hash::phc::PasswordHash;
 use std::{
@@ -72,14 +72,18 @@ fn parse_basic(headers: &HeaderMap) -> Option<(String, String)> {
     Some((user.to_owned(), pass.to_owned()))
 }
 
-async fn authenticate(state: &AuthState, headers: &HeaderMap) -> bool {
-    let Some((user, pass)) = parse_basic(headers) else {
-        return false;
-    };
-    let Some(hash) = state.users.get(&user).cloned() else {
-        return false;
-    };
+/// The user a request authenticated as (a request extension, set by [`basic_auth`]).
+#[derive(Clone, Debug)]
+pub(crate) struct AuthenticatedUser(pub(crate) String);
+
+/// The user, if the credentials are valid.
+async fn authenticate(state: &AuthState, headers: &HeaderMap) -> Option<String> {
+    let (user, pass) = parse_basic(headers)?;
+    let hash = state.users.get(&user).cloned()?;
+    verify(state, &user, pass, hash).await.then_some(user)
+}
 
+async fn verify(state: &AuthState, user: &str, pass: String, hash: String) -> bool {
     let key = *blake3::hash(format!("{user}\0{pass}\0{hash}").as_bytes()).as_bytes();
 
     // Fast path. The shard guard lives only until the end of this `match`;
@@ -124,10 +128,10 @@ async fn authenticate(state: &AuthState, headers: &HeaderMap) -> bool {
 pub async fn basic_auth(
     State(state): State<AuthState>,
     headers: HeaderMap,
-    request: Request<Body>,
+    mut request: Request<Body>,
     next: axum::middleware::Next,
 ) -> Response {
-    if !authenticate(&state, &headers).await {
+    let Some(user) = authenticate(&state, &headers).await else {
         sleep(Duration::from_millis(1500)).await;
         return (
             StatusCode::UNAUTHORIZED,
@@ -135,7 +139,8 @@ pub async fn basic_auth(
             "Unauthorized",
         )
             .into_response();
-    }
+    };
 
+    request.extensions_mut().insert(AuthenticatedUser(user));
     next.run(request).await
 }