VVRONGG/backside | Gitverse

src/lib.rs
64 строки2 KB
VVrongg
feat: image management endpoints + CORS for admin SPA
22 май 2026, 21:04
22 май 2026, 21:049186ff6
pub mod auth;
pub mod error;
pub mod service;
pub mod transport;

use axum::{
    Router,
    extract::DefaultBodyLimit,
    routing::{get, post},
};
use sqlx::MySqlPool;
use tower_http::cors::CorsLayer;

use crate::transport::handlers::{
    add_object_images, create_object, create_route, delete_object_image, delete_objective,
    delete_route, get_objective, get_objective_image, get_route, list_routes, login_admin,
    reorder_object_images, sync_objectives, sync_routes, update_objective, update_route,
};

/// Max request body size. Objective images arrive base64-encoded inside the JSON
/// body (~33% larger than the raw bytes) and land in a MEDIUMBLOB column, so
/// axum's default 2 MB limit would reject ordinary photo uploads.
pub const MAX_BODY_BYTES: usize = 32 * 1024 * 1024;

/// Build the application router with every route wired to `pool`. Kept separate
/// from `main` so integration tests can mount the same app against a test pool.
pub fn app(pool: MySqlPool) -> Router {
    Router::new()
        .route("/health", get(health))
        .route("/auth/login", post(login_admin))
        .route("/objectives", post(create_object))
        .route("/objectives/sync", get(sync_objectives))
        .route(
            "/objectives/{id}",
            get(get_objective)
                .patch(update_objective)
                .delete(delete_objective),
        )
        .route(
            "/objectives/{id}/images",
            post(add_object_images).put(reorder_object_images),
        )
        .route(
            "/objectives/{id}/images/{img_id}",
            get(get_objective_image).delete(delete_object_image),
        )
        .route("/routes", post(create_route).get(list_routes))
        .route("/routes/sync", get(sync_routes))
        .route(
            "/routes/{id}",
            get(get_route).patch(update_route).delete(delete_route),
        )
        .layer(DefaultBodyLimit::max(MAX_BODY_BYTES))
        // Dev-only: the admin SPA runs on a different origin (Vite dev server),
        // so the browser needs CORS to reach this API. Lock this down to the
        // real admin origin before any non-local deployment.
        .layer(CorsLayer::permissive())
        .with_state(pool)
}

/// Liveness probe.
async fn health() -> &'static str {
    "ok"
}