5686483572

pending completion

Build # 5686483572

Build Type

push

github

Committed by

web-flow

Commit Message

chore: Split `ApiInitError` out from `ApiError` (#1798)

Run Details

50 of 50 new or added lines in 12 files covered. (100.0%)

45647 of 59023 relevant lines covered (77.34%)

39649.01 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

63.49

/dozer-api/src/auth/api.rs

use actix_web::{
    dev::ServiceRequest,
    web::{self, ReqData},
    Error, HttpMessage, HttpRequest, HttpResponse,
};
use actix_web_httpauth::extractors::bearer::BearerAuth;
use dozer_types::{models::api_security::ApiSecurity, serde_json::json};
use tonic::{Response, Status};

use crate::errors::{ApiError, AuthError};

use super::{Access, Authorizer};
use dozer_types::grpc_types::auth::GetAuthTokenResponse;

pub fn auth_grpc(
    access: Option<&Access>,
    tenant_access: String,
    api_security: Option<ApiSecurity>,
) -> Result<Response<GetAuthTokenResponse>, Status> {
    let access = match access {
        Some(access) => access.clone(),
        None => Access::All,
    };

    match access {
        // Master Key or Uninitialized
        Access::All => {
            let tenant_access = dozer_types::serde_json::from_str(tenant_access.as_str())
                .map_err(ApiError::InvalidAccessFilter)?;

            let api_security = api_security
                .ok_or_else(|| Status::permission_denied("Cannot access this method."))?;

            let ApiSecurity::Jwt(secret) = api_security;

            let auth = Authorizer::new(&secret, None, None);
            let token = auth.generate_token(tenant_access, None).unwrap();
            Ok(Response::new(GetAuthTokenResponse { token }))
        }
        Access::Custom(_) => Err(Status::permission_denied("Cannot access this method.")),
    }
}

pub async fn auth_route(
    access: Option<ReqData<Access>>,
    req: HttpRequest,
    tenant_access: web::Json<Access>,
) -> Result<HttpResponse, ApiError> {
    let access = match access {
        Some(access) => access.into_inner(),
        None => Access::All,
    };

    match access {
        // Master Key or Uninitialized
        Access::All => {
            let secret = get_secret(&req)?;
            let auth = Authorizer::new(secret, None, None);
            let token = auth.generate_token(tenant_access.0, None).unwrap();
            Ok(HttpResponse::Ok().body(json!({ "token": token }).to_string()))
        }
        Access::Custom(_) => Err(ApiError::ApiAuthError(AuthError::Unauthorized)),
    }
}

fn get_secret(req: &HttpRequest) -> Result<&str, AuthError> {
    let api_security = req
        .app_data::<ApiSecurity>()
        .ok_or(AuthError::Unauthorized)?;

    match api_security {
        ApiSecurity::Jwt(secret) => Ok(secret.as_str()),
    }
}
pub async fn validate(
    req: ServiceRequest,
    credentials: BearerAuth,
) -> Result<ServiceRequest, (Error, ServiceRequest)> {
    let api_security = req
        .app_data::<ApiSecurity>()
        .expect("We only validate bearer tokens if ApiSecurity is set");
    match api_security {
        ApiSecurity::Jwt(secret) => {
            let api_auth = Authorizer::new(secret, None, None);
            let res = api_auth
                .validate_token(credentials.token())
                .map_err(|e| (Error::from(ApiError::ApiAuthError(e))));

            match res {
                Ok(claims) => {
                    // Provide access to all
                    req.extensions_mut().insert(claims.access);
                    Ok(req)
                }
                Err(e) => Err((e, req)),
            }
        }
    }
}

1	use actix_web::{
2	dev::ServiceRequest,
3	web::{self, ReqData},
4	Error, HttpMessage, HttpRequest, HttpResponse,
5	};
6	use actix_web_httpauth::extractors::bearer::BearerAuth;
7	use dozer_types::{models::api_security::ApiSecurity, serde_json::json};
8	use tonic::{Response, Status};
9
10	use crate::errors::{ApiError, AuthError};
11
12	use super::{Access, Authorizer};
13	use dozer_types::grpc_types::auth::GetAuthTokenResponse;
14
15	pub fn auth_grpc(	×
16	access: Option<&Access>,	×
17	tenant_access: String,	×
18	api_security: Option<ApiSecurity>,	×
19	) -> Result<Response<GetAuthTokenResponse>, Status> {	×
20	let access = match access {	×
21	Some(access) => access.clone(),	×
22	None => Access::All,	×
23	};
24
25	match access {	×
26	// Master Key or Uninitialized
27	Access::All => {
28	let tenant_access = dozer_types::serde_json::from_str(tenant_access.as_str())	×
29	.map_err(ApiError::InvalidAccessFilter)?;	×
30
31	let api_security = api_security	×
32	.ok_or_else(\|\| Status::permission_denied("Cannot access this method."))?;	×
33
34	let ApiSecurity::Jwt(secret) = api_security;	×
35		×
36	let auth = Authorizer::new(&secret, None, None);	×
37	let token = auth.generate_token(tenant_access, None).unwrap();	×
38	Ok(Response::new(GetAuthTokenResponse { token }))	×
39	}
40	Access::Custom(_) => Err(Status::permission_denied("Cannot access this method.")),	×
41	}
42	}	×
43
44	pub async fn auth_route(	1✔
45	access: Option<ReqData<Access>>,	1✔
46	req: HttpRequest,	1✔
47	tenant_access: web::Json<Access>,	1✔
48	) -> Result<HttpResponse, ApiError> {	1✔
49	let access = match access {	1✔
50	Some(access) => access.into_inner(),	1✔
51	None => Access::All,	×
52	};
53
54	match access {	1✔
55	// Master Key or Uninitialized
56	Access::All => {
57	let secret = get_secret(&req)?;	1✔
58	let auth = Authorizer::new(secret, None, None);	1✔
59	let token = auth.generate_token(tenant_access.0, None).unwrap();	1✔
60	Ok(HttpResponse::Ok().body(json!({ "token": token }).to_string()))	1✔
61	}
62	Access::Custom(_) => Err(ApiError::ApiAuthError(AuthError::Unauthorized)),	×
63	}
64	}	1✔
65
66	fn get_secret(req: &HttpRequest) -> Result<&str, AuthError> {	1✔
67	let api_security = req	1✔
68	.app_data::<ApiSecurity>()	1✔
69	.ok_or(AuthError::Unauthorized)?;	1✔
70
71	match api_security {	1✔
72	ApiSecurity::Jwt(secret) => Ok(secret.as_str()),	1✔
73	}
74	}	1✔
75	pub async fn validate(	2✔
76	req: ServiceRequest,	2✔
77	credentials: BearerAuth,	2✔
78	) -> Result<ServiceRequest, (Error, ServiceRequest)> {	2✔
79	let api_security = req	2✔
80	.app_data::<ApiSecurity>()	2✔
81	.expect("We only validate bearer tokens if ApiSecurity is set");	2✔
82	match api_security {	2✔
83	ApiSecurity::Jwt(secret) => {	2✔
84	let api_auth = Authorizer::new(secret, None, None);	2✔
85	let res = api_auth	2✔
86	.validate_token(credentials.token())	2✔
87	.map_err(\|e\| (Error::from(ApiError::ApiAuthError(e))));	2✔
88		2✔
89	match res {	2✔
90	Ok(claims) => {	2✔
91	// Provide access to all	2✔
92	req.extensions_mut().insert(claims.access);	2✔
93	Ok(req)	2✔
94	}
95	Err(e) => Err((e, req)),	×
96	}
97	}
98	}
99	}	2✔

getdozer / dozer / 5686483572

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous