arcature 0.1.2

Arcature: an opinionated full-stack Rust web framework. One package, batteries included.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110

//! Origin policy for realtime endpoints (WebSocket + SSE).

use std::fmt;

use axum::http::HeaderValue;

/// A verified, non-ASCII-safe origin string. Built from a trusted source or
/// parsed from a header (non-ASCII is rejected).
#[derive(Debug, Clone, PartialEq, Eq, Hash)]
pub struct VerifiedOrigin(String);

impl VerifiedOrigin {
    /// Build from a trusted string (no validation).
    #[must_use]
    pub fn from_trusted(s: impl Into<String>) -> Self {
        Self(s.into())
    }

    /// Build from a header value. Returns `None` if the value is not valid
    /// ASCII.
    #[must_use]
    pub fn from_header(value: &HeaderValue) -> Option<Self> {
        let s = value.to_str().ok()?;
        if !s.bytes().all(|b| b.is_ascii()) {
            return None;
        }
        Some(Self(s.to_string()))
    }

    /// The origin as a string slice.
    #[must_use]
    pub fn as_str(&self) -> &str {
        &self.0
    }
}

impl fmt::Display for VerifiedOrigin {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str(&self.0)
    }
}

/// The decision from an origin policy check.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum OriginDecision {
    /// The origin is allowed.
    Allowed,
    /// The origin is denied.
    Denied,
}

/// The origin policy: deny all, allow an exact origin, or allow a set.
#[derive(Debug, Clone, Default)]
pub enum OriginPolicy {
    /// Deny all origins (the default).
    #[default]
    DenyAll,
    /// Allow a single exact origin.
    AllowExact { origin: VerifiedOrigin },
    /// Allow a set of origins.
    AllowSet { origins: Vec<VerifiedOrigin> },
}

impl OriginPolicy {
    /// Deny all origins.
    #[must_use]
    pub fn deny_all() -> Self {
        Self::DenyAll
    }

    /// Allow a single exact origin.
    #[must_use]
    pub fn allow_exact(origin: VerifiedOrigin) -> Self {
        Self::AllowExact { origin }
    }

    /// Allow a set of origins.
    #[must_use]
    pub fn allow_set(origins: Vec<VerifiedOrigin>) -> Self {
        Self::AllowSet { origins }
    }

    /// Check a request's origin header against the policy.
    #[must_use]
    pub fn authorize(&self, header: Option<&HeaderValue>) -> OriginDecision {
        match self {
            Self::DenyAll => OriginDecision::Denied,
            Self::AllowExact { origin } => {
                if let Some(h) = header
                    && let Some(v) = VerifiedOrigin::from_header(h)
                    && &v == origin
                {
                    OriginDecision::Allowed
                } else {
                    OriginDecision::Denied
                }
            }
            Self::AllowSet { origins } => {
                if let Some(h) = header
                    && let Some(v) = VerifiedOrigin::from_header(h)
                    && origins.contains(&v)
                {
                    OriginDecision::Allowed
                } else {
                    OriginDecision::Denied
                }
            }
        }
    }
}