core/src/auth.rs - main - mcmare/RustAPI

use axum::{extract::Request, extract::State, http::header, middleware::Next, response::Response};
use std::sync::Arc;
use subtle::ConstantTimeEq;

use crate::error::ApiError;

/// Static bearer/API-key tokens accepted by the server.
#[derive(Clone)]
pub struct AuthConfig {
    tokens: Arc<Vec<String>>,
}

impl AuthConfig {
    pub fn new(tokens: Vec<String>) -> Self {
        Self {
            tokens: Arc::new(tokens),
        }
    }

    fn is_valid(&self, presented: &str) -> bool {
        // Constant-time comparison against every configured token so token length/content
        // can't be inferred from response timing.
        self.tokens.iter().any(|t| {
            let a = t.as_bytes();
            let b = presented.as_bytes();
            a.len() == b.len() && bool::from(a.ct_eq(b))
        })
    }
}

fn extract_token(req: &Request) -> Option<String> {
    if let Some(value) = req.headers().get(header::AUTHORIZATION) {
        let value = value.to_str().ok()?;
        if let Some(token) = value.strip_prefix("Bearer ") {
            return Some(token.to_string());
        }
    }
    if let Some(value) = req.headers().get("x-api-key") {
        return value.to_str().ok().map(|s| s.to_string());
    }
    None
}

pub async fn require_auth(
    State(auth): State<AuthConfig>,
    req: Request,
    next: Next,
) -> Result<Response, ApiError> {
    let token = extract_token(&req).ok_or(ApiError::Unauthorized)?;
    if !auth.is_valid(&token) {
        return Err(ApiError::Unauthorized);
    }
    Ok(next.run(req).await)
}