aitzol/Plume
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

New request guard: Authorization<Action, Scope>

Browse Source 
Filter requests that don't have an API token authorized to read or write
a specific scope;
This commit is contained in:
Baptiste Gelez
2018-10-30 18:13:49 +01:00
parent cd4ae5b7f5
commit 31641b1ea1
4 changed files with 68 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/posts.rs
+9 -20
View File
@@ -7,31 +7,20 @@ use serde_qs;
use plume_api::posts::PostEndpoint;
use plume_models::{
Connection,
api_tokens::ApiToken,
db_conn::DbConn,
posts::Post,
};
use api::authorization::*;
#[get("/posts/<id>")]
fn get(id: i32, conn: DbConn, token: ApiToken) -> Json<serde_json::Value> {
if token.can_read("posts") {
let post = <Post as Provider<Connection>>::get(&*conn, id).ok();
Json(json!(post))
} else {
Json(json!({
"error": "Unauthorized"
}))
}
fn get(id: i32, conn: DbConn, _auth: Authorization<Read, Post>) -> Json<serde_json::Value> {
let post = <Post as Provider<Connection>>::get(&*conn, id).ok();
Json(json!(post))
}
#[get("/posts")]
fn list(conn: DbConn, uri: &Origin, token: ApiToken) -> Json<serde_json::Value> {
if token.can_read("posts") {
let query: PostEndpoint = serde_qs::from_str(uri.query().unwrap_or("")).expect("api::list: invalid query error");
let post = <Post as Provider<Connection>>::list(&*conn, query);
Json(json!(post))
} else {
Json(json!({
"error": "Unauthorized"
}))
}}
fn list(conn: DbConn, uri: &Origin, _auth: Authorization<Read, Post>) -> Json<serde_json::Value> {
let query: PostEndpoint = serde_qs::from_str(uri.query().unwrap_or("")).expect("api::list: invalid query error");
let post = <Post as Provider<Connection>>::list(&*conn, query);
Json(json!(post))
}