arcature 0.1.0

Arcature: an opinionated full-stack Rust web framework. One package, batteries included.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171

//! The redirect vocabulary, end to end through a real session.
//!
//! `redirect().route(..)` and `redirect().with(..)` are the two halves of the
//! Post/Redirect/Get pattern, and both used to be documented as not
//! implemented: the first returned `400`, the second silently dropped its
//! data. Neither could work from `IntoResponse` alone, which sees no request,
//! no route table and no session.
//!
//! The fix is [`RedirectMapper`], a layer above the handler. The unit tests
//! next to it drive it against a stub leaf service. This file is the part
//! those cannot cover: a genuine `SessionLayer` with a real store, and three
//! requests in sequence, because "flashed for exactly one request" is a claim
//! about the *second* and *third* requests rather than the first.

#![cfg(feature = "auth")]

use arcature::auth::{Flash, SessionConfig};
use arcature::http::response::{RedirectResponse, redirect};
use arcature::routing::{RedirectMapper, Route, Routes};
use axum::Router;
use axum::body::Body;
use axum::http::{Request, Response, StatusCode, header};
use tower::ServiceExt;
use tower_sessions_memory_store::MemoryStore;

/// A 64-byte signing key. Fixed, because a test that generates one learns
/// nothing and fails differently on each run.
const KEY: &[u8] = &[7u8; 64];

/// Flashes a status message and redirects to a named route.
async fn save() -> RedirectResponse {
    redirect()
        .route("users.show", 7u64)
        .with("status", "Profile updated")
}

/// Echoes the flashed status back, or `-` if there is none.
async fn show(flash: Flash) -> String {
    flash.get("status").unwrap_or("-").to_string()
}

/// The application under test: mapper inside, session outside.
///
/// That nesting is not incidental. The mapper writes flash data through a
/// session handle it lifts out of the request extensions, so the session
/// layer has to have already put one there, and it has to still be above on
/// the way out to save the record and set the cookie.
fn app() -> Router {
    let routes: Routes = Routes::new([
        Route::post("/save", save).name("save"),
        Route::get("/users/{id}", show).name("users.show"),
    ]);
    let table = routes.table();
    let session = SessionConfig::dev(KEY)
        .expect("a 64-byte key is valid")
        .into_layer(MemoryStore::default())
        .expect("the dev session config is valid");

    routes
        .into_router()
        .layer(RedirectMapper::new(table))
        .layer(session)
}

/// The `Set-Cookie` the session layer issued, in a form that can be sent back
/// as a `Cookie` header.
fn cookie(response: &Response<Body>) -> String {
    response
        .headers()
        .get(header::SET_COOKIE)
        .expect("the session layer set a cookie")
        .to_str()
        .expect("cookies are ASCII")
        .split(';')
        .next()
        .expect("split always yields one element")
        .to_string()
}

async fn body(response: Response<Body>) -> String {
    let bytes = axum::body::to_bytes(response.into_body(), 64 * 1024)
        .await
        .expect("the test bodies are tiny");
    String::from_utf8(bytes.to_vec()).expect("the handler returns UTF-8")
}

#[tokio::test]
async fn a_flashed_redirect_resolves_its_name_and_survives_exactly_one_request() {
    let app = app();

    // 1. The POST. The name resolves to a path, and the session picks up the
    //    flash data on the way out.
    let posted = app
        .clone()
        .oneshot(
            Request::post("/save")
                .body(Body::empty())
                .expect("a valid request"),
        )
        .await
        .expect("the router is infallible");

    assert_eq!(
        posted.headers().get(header::LOCATION).unwrap(),
        "/users/7",
        "`route(\"users.show\", 7)` should resolve against the table"
    );
    let session = cookie(&posted);

    // 2. The GET the browser follows to. The flash is readable here and
    //    nowhere else.
    let followed = app
        .clone()
        .oneshot(
            Request::get("/users/7")
                .header(header::COOKIE, &session)
                .body(Body::empty())
                .expect("a valid request"),
        )
        .await
        .expect("the router is infallible");

    assert_eq!(followed.status(), StatusCode::OK);
    assert_eq!(body(followed).await, "Profile updated");

    // 3. A reload of the same page. Reading the flash consumed it, so a
    //    refresh must not show the toast a second time.
    let reloaded = app
        .oneshot(
            Request::get("/users/7")
                .header(header::COOKIE, &session)
                .body(Body::empty())
                .expect("a valid request"),
        )
        .await
        .expect("the router is infallible");

    assert_eq!(body(reloaded).await, "-", "flash data outlived its request");
}

#[tokio::test]
async fn a_second_session_cannot_read_the_first_session_flash() {
    let app = app();

    let posted = app
        .clone()
        .oneshot(
            Request::post("/save")
                .body(Body::empty())
                .expect("a valid request"),
        )
        .await
        .expect("the router is infallible");
    let _ = cookie(&posted);

    // No cookie: a different visitor entirely.
    let stranger = app
        .oneshot(
            Request::get("/users/7")
                .body(Body::empty())
                .expect("a valid request"),
        )
        .await
        .expect("the router is infallible");

    assert_eq!(
        body(stranger).await,
        "-",
        "flash data leaked across sessions"
    );
}