diff options
Diffstat (limited to 'src/api/mod.rs')
| -rw-r--r-- | src/api/mod.rs | 35 |
1 files changed, 20 insertions, 15 deletions
diff --git a/src/api/mod.rs b/src/api/mod.rs index e4ccee6..3e944dc 100644 --- a/src/api/mod.rs +++ b/src/api/mod.rs @@ -1,6 +1,7 @@ //! HTTP API: router, the API description and shared response helpers (the store's //! own are in `store`). +mod access; pub(crate) mod auth; mod changes; mod config; @@ -75,21 +76,25 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) -> ); } - api.layer(middleware::from_fn_with_state(auth_state, basic_auth)) - // The hand-written spec (`docs/openapi.yaml`), and the Swagger UI showing it. - .merge( - // Relative to the UI's page (`/swagger-ui/`), so it is found behind a proxy that - // serves the API under a path of its own too. - SwaggerUi::new("/swagger-ui") - .config(utoipa_swagger_ui::Config::from("../openapi.yaml")), - ) - .route("/openapi.yaml", get(openapi_spec)) - .route("/health", get(health::node_health)) - .route("/ready", get(health::ready)) - // Outermost, so authentication failures get the error body too. - .layer(middleware::from_fn(json_errors)) - .layer(middleware::from_fn(relative_redirects)) - .with_state(state) + // Inside authentication, which finds the user: what the user may do. + api.layer(middleware::from_fn_with_state( + state.clone(), + access::authorize, + )) + .layer(middleware::from_fn_with_state(auth_state, basic_auth)) + // The hand-written spec (`docs/openapi.yaml`), and the Swagger UI showing it. + .merge( + // Relative to the UI's page (`/swagger-ui/`), so it is found behind a proxy that + // serves the API under a path of its own too. + SwaggerUi::new("/swagger-ui").config(utoipa_swagger_ui::Config::from("../openapi.yaml")), + ) + .route("/openapi.yaml", get(openapi_spec)) + .route("/health", get(health::node_health)) + .route("/ready", get(health::ready)) + // Outermost, so authentication failures get the error body too. + .layer(middleware::from_fn(json_errors)) + .layer(middleware::from_fn(relative_redirects)) + .with_state(state) } /// The HTTP router of a node that only relays (`--relay-only`): its figures and the log |