User authentication should be done in middleware

[mickvandijke]

User authentication is currently done manually in each endpoint that requires authentication. Ideally, we would have an authentication middleware instead. The authentication middleware could pass Option<User> to the endpoint handler.

[josecelano]

Hi @WarmBeer in the new Axum implementation I'm using an extractor:

https://github.com/torrust/torrust-index-backend/blob/develop/src/web/api/v1/extractors/bearer_token.rs

because some endpoints require authentication and others don't.

And this is how it looks like in the upload torrent endpoint:

pub async fn upload_torrent_handler(
    State(app_data): State<Arc<AppData>>,
    Extract(maybe_bearer_token): Extract,
    multipart: Multipart,
) -> Response {
    let user_id = match app_data.auth.get_user_id_from_bearer_token(&maybe_bearer_token).await {
        Ok(user_id) => user_id,
        Err(error) => return error.into_response(),
    };

    let torrent_request = match get_torrent_request_from_payload(multipart).await {
        Ok(torrent_request) => torrent_request,
        Err(error) => return error.into_response(),
    };

    let info_hash = torrent_request.torrent.info_hash().clone();

    match app_data.torrent_service.add_torrent(torrent_request, user_id).await {
        Ok(torrent_id) => new_torrent_response(torrent_id, &info_hash).into_response(),
        Err(error) => error.into_response(),
    }
}

We could improve it. We could have a new Axum extractor that could be Optional:

ExtractLoggedInUser(logged_in_user): ExtractLoggedInUser, 
// or
ExtractAuthenticatedUser(authenticated_user): ExtractAuthenticatedUser,

pub async fn upload_torrent_handler(
    State(app_data): State<Arc<AppData>>,
    Extract(maybe_bearer_token): Extract,
    user_id: Option<ExtractAuthenticatedUser>
    multipart: Multipart,
)

That way, we could remove this from the handler:

    let user_id = match app_data.auth.get_user_id_from_bearer_token(&maybe_bearer_token).await {
        Ok(user_id) => user_id,
        Err(error) => return error.into_response(),
    };

In case the endpoint requires the user to be authenticated, we could use it without the optional:

pub async fn upload_torrent_handler(
    State(app_data): State<Arc<AppData>>,
    ExtractAuthenticatedUser(user_id): ExtractAuthenticatedUser
    multipart: Multipart,
)

[mario-nt]

WIP.

[josecelano]

Hi @mario-nt just a clarification, regarding authentication there are three types of endpoints:

1. Endpoints that don't require a logged-in user at all.
2. Endpoints that require a logged-in user (for example, to upload a torrent).
3. Endpoint that a logged-in user is optional. If you are logged in you get a different response but you can request the same endpoint without a logged-in user.

The "extractor that could be " would be used for the type-3 endpoitns.

[josecelano]

I've been discussing with @mario-nt how to use the auth service in the middleware.

pub async fn upload_torrent_handler(
    State(app_data): State<Arc<AppData>>,
    Extract(maybe_bearer_token): Extract,
    multipart: Multipart,
) -> Response {
    let user_id = match app_data.auth.get_user_id_from_bearer_token(&maybe_bearer_token).await {
        Ok(user_id) => user_id,
        Err(error) => return error.into_response(),
    };

    let add_torrent_form = match build_add_torrent_request_from_payload(multipart).await {
        Ok(torrent_request) => torrent_request,
        Err(error) => return error.into_response(),
    };

    match app_data.torrent_service.add_torrent(add_torrent_form, user_id).await {
        Ok(response) => new_torrent_response(&response).into_response(),
        Err(error) => error.into_response(),
    }
}

We want to move this code:

    let user_id = match app_data.auth.get_user_id_from_bearer_token(&maybe_bearer_token).await {
        Ok(user_id) => user_id,
        Err(error) => return error.into_response(),
    };

to the middleware. We found these links:

How do you access state in a custom Extractor?:

• How do you access state in a custom Extractor? tokio-rs/axum#1732 (comment)
• https://docs.rs/axum/0.6.4/axum/extract/struct.State.html#for-library-authors