a31669930d
Implement comprehensive permission-based access control system with share management. Features: - Permission model (Read, Write, Admin) - Share model for resource sharing between users - Permission middleware for endpoint protection - Share management API endpoints - Permission check endpoints - MongoDB repository implementations for all models Files Added: - backend/src/db/permission.rs - Permission repository - backend/src/db/share.rs - Share repository - backend/src/db/user.rs - User repository - backend/src/db/profile.rs - Profile repository - backend/src/db/appointment.rs - Appointment repository - backend/src/db/family.rs - Family repository - backend/src/db/health_data.rs - Health data repository - backend/src/db/lab_result.rs - Lab results repository - backend/src/db/medication.rs - Medication repository - backend/src/db/mongodb_impl.rs - MongoDB trait implementations - backend/src/handlers/permissions.rs - Permission API handlers - backend/src/handlers/shares.rs - Share management handlers - backend/src/middleware/permission.rs - Permission checking middleware API Endpoints: - GET /api/permissions/check - Check user permissions - POST /api/shares - Create new share - GET /api/shares - List user shares - GET /api/shares/:id - Get specific share - PUT /api/shares/:id - Update share - DELETE /api/shares/:id - Delete share Status: Phase 2.5 COMPLETE - Building successfully, ready for production
51 lines
1.2 KiB
Rust
51 lines
1.2 KiB
Rust
use axum::{
|
|
extract::{Request, State},
|
|
http::StatusCode,
|
|
middleware::Next,
|
|
response::Response,
|
|
};
|
|
use crate::auth::jwt::Claims;
|
|
use crate::config::AppState;
|
|
|
|
pub async fn jwt_auth_middleware(
|
|
State(state): State<AppState>,
|
|
mut req: Request,
|
|
next: Next,
|
|
) -> Result<Response, StatusCode> {
|
|
let headers = req.headers();
|
|
|
|
// Extract Authorization header
|
|
let auth_header = headers
|
|
.get("Authorization")
|
|
.and_then(|h| h.to_str().ok())
|
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
|
|
|
// Check Bearer token format
|
|
if !auth_header.starts_with("Bearer ") {
|
|
return Err(StatusCode::UNAUTHORIZED);
|
|
}
|
|
|
|
let token = &auth_header[7..]; // Remove "Bearer " prefix
|
|
|
|
// Verify token
|
|
let claims = state
|
|
.jwt_service
|
|
.validate_token(token)
|
|
.map_err(|_| StatusCode::UNAUTHORIZED)?;
|
|
|
|
// Add claims to request extensions for handlers to use
|
|
req.extensions_mut().insert(claims);
|
|
|
|
Ok(next.run(req).await)
|
|
}
|
|
|
|
// Extension method to extract claims from request
|
|
pub trait RequestClaimsExt {
|
|
fn claims(&self) -> Option<&Claims>;
|
|
}
|
|
|
|
impl RequestClaimsExt for Request {
|
|
fn claims(&self) -> Option<&Claims> {
|
|
self.extensions().get::<Claims>()
|
|
}
|
|
}
|