anzar-shared 0.9.21

Anzar is a lightweight authentication and authorization framework that runs as a separate microservice
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

use std::sync::Arc;

use chrono::{Duration, Utc};

use crate::error::{CoreError, InternalError, ResourceKind, Result, TokenErrorType};

use super::model::SigningKey;
use super::ports::database::DatabaseAdapter;
use super::ports::query::QueryBuilder;

#[derive(Clone)]
pub struct SigningKeysRepository {
    adapter: Arc<dyn DatabaseAdapter<SigningKey>>,
}

impl SigningKeysRepository {
    pub fn new(adapter: Arc<dyn DatabaseAdapter<SigningKey>>) -> Self {
        Self { adapter }
    }
}

impl SigningKeysRepository {
    #[tracing::instrument(name = "db.signing_key.insert", skip(self, signing_key))]
    pub async fn insert(&self, signing_key: SigningKey) -> Result<String> {
        match self.adapter.insert(signing_key).await {
            Ok(id) => Ok(id),
            Err(err) => {
                tracing::error!("Failed to insert signing_key to database - {err}");
                Err(CoreError::Internal(InternalError::Database(
                    err.to_string(),
                )))
            }
        }
    }

    #[tracing::instrument(name = "db.signing_keys.find", skip(self))]
    pub async fn find(&self) -> Result<SigningKey> {
        let filter = QueryBuilder::default().eq("status", "active");

        match self.adapter.find_one(filter).await {
            Ok(Some(key)) => Ok(key),
            // FIXME use Permission not Role
            Ok(None) => Err(CoreError::NotFound(ResourceKind::Token {
                token_type: TokenErrorType::Token,
            })),
            Err(err) => {
                tracing::error!(error_code = "InternalError::Database", error = %err, "Database query failed");
                Err(err)
            }
        }
    }

    #[tracing::instrument(name = "db.signingkeys.find_valid_keys", skip(self))]
    pub async fn find_valid_keys(&self) -> Result<Vec<SigningKey>> {
        let filter = QueryBuilder::default()
            .ne("status", "revoked")
            .gt("expiresAt", Utc::now());

        match self.adapter.find_all(filter).await {
            Ok(permissions) => Ok(permissions),
            Err(err) => {
                tracing::error!(error_code = "InternalError::Database", error = %err, "Database query failed");
                Err(err)
            }
        }
    }

    #[tracing::instrument(name = "db.signingkeys.findall", skip(self))]
    pub async fn find_all(&self) -> Result<Vec<SigningKey>> {
        let filter = QueryBuilder::default();

        match self.adapter.find_all(filter).await {
            Ok(keys) => Ok(keys),
            Err(err) => {
                tracing::error!(error_code = "InternalError::Database", error = %err, "Database query failed");
                Err(err)
            }
        }
    }

    #[tracing::instrument(name = "db.signing_keys.find", skip(self))]
    pub async fn retire_oldkey(&self, max_token_ttl: i64) -> Result<SigningKey> {
        let filter = QueryBuilder::default().eq("status", "active");
        let update = QueryBuilder::default()
            .set("status", "retired")
            .set("rotatedAt", Utc::now())
            .set("expiresAt", Utc::now() + Duration::seconds(max_token_ttl));

        match self.adapter.find_one_and_update(filter, update).await {
            Ok(Some(key)) => Ok(key),
            Ok(None) => Err(CoreError::NotFound(ResourceKind::Token {
                token_type: TokenErrorType::Token,
            })),
            Err(err) => {
                tracing::error!(error_code = "InternalError::Database", error = %err, "Database query failed");
                Err(err)
            }
        }
    }

    #[tracing::instrument(name = "db.signing_keys.revoke", skip(self))]
    pub async fn revoke_key(&self, id: &str) -> Result<SigningKey> {
        let filter = QueryBuilder::default().eq("kid", id);
        let update = QueryBuilder::default().set("status", "revoked");

        match self.adapter.find_one_and_update(filter, update).await {
            Ok(Some(key)) => Ok(key),
            Ok(None) => Err(CoreError::NotFound(ResourceKind::Token {
                token_type: TokenErrorType::Token,
            })),
            Err(err) => {
                tracing::error!(error_code = "InternalError::Database", error = %err, "Database query failed");
                Err(err)
            }
        }
    }

    #[tracing::instrument(name = "db.permission.find", skip(self, id))]
    pub async fn delete(&self, id: &str) -> Result<()> {
        let filter = QueryBuilder::default().eq("id", id);

        match self.adapter.delete_one(filter).await {
            Ok(_) => Ok(()),
            Err(err) => {
                tracing::error!(error_code = "InternalError::Database", error = %err, "Database query failed");
                Err(err)
            }
        }
    }
}