From ec70060ae5fa665953741da921e28031b56bc5e0 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:09 +0100 Subject: auth: logging in, and tokens as bearers POST /auth/login (by htpasswd or the proxy), /auth/refresh, /auth/logout, GET /auth/whoami; every request may bring Authorization: Bearer instead of a password. --token-lifetime and --session-lifetime. Auth plan M2. --- src/api/mod.rs | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src/api/mod.rs') diff --git a/src/api/mod.rs b/src/api/mod.rs index 03b4fdd..b62163e 100644 --- a/src/api/mod.rs +++ b/src/api/mod.rs @@ -12,6 +12,7 @@ mod document; mod health; pub(crate) mod listen; mod log; +mod login; mod peers; mod stats; mod store; @@ -62,7 +63,12 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) -> .route("/admin/changes", get(changes::get_changes)) .route("/admin/changes/{*key}", get(changes::get_changes_at)) .route("/admin/config", get(config::get_config)) + .route("/auth/login", axum::routing::post(login::login)) + .route("/auth/refresh", axum::routing::post(login::refresh)) + .route("/auth/logout", axum::routing::post(login::logout)) + .route("/auth/whoami", get(login::whoami)) .route("/admin/users", get(users::list).post(users::add_several)) + .route("/admin/users/{name}/tokens", delete(users::revoke_tokens)) .route( "/admin/users/{name}", get(users::get).post(users::add).delete(users::remove), @@ -97,6 +103,8 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) -> access::authorize, )) .layer(middleware::from_fn_with_state(auth_state, basic_auth)) + // Outside authentication: a token, if the request brings one, names the user. + .layer(middleware::from_fn_with_state(state.clone(), login::bearer)) // The hand-written spec (`docs/openapi.yaml`), and the Swagger UI showing it. .merge( // Relative to the UI's page (`/swagger-ui/`), so it is found behind a proxy that -- cgit v1.3.1