cloudillo_admin/
perm.rs

1//! Admin permission middleware
2
3use axum::{
4	extract::{Request, State},
5	middleware::Next,
6	response::Response,
7};
8
9use cloudillo_core::extract::Auth;
10
11use crate::prelude::*;
12
13/// Middleware that checks if the current user has admin role (SADM)
14///
15/// This middleware is simpler than `check_perm_profile` as it doesn't require
16/// a path parameter - it just checks if the authenticated user has admin privileges.
17pub async fn require_admin(
18	State(_app): State<App>,
19	Auth(auth_ctx): Auth,
20	req: Request,
21	next: Next,
22) -> Result<Response, Error> {
23	// Check if user has SADM (site admin) role
24	if !auth_ctx.roles.iter().any(|r| r.as_ref() == "SADM") {
25		tracing::warn!(
26			subject = %auth_ctx.id_tag,
27			roles = ?auth_ctx.roles,
28			"Admin permission denied - SADM role required"
29		);
30		return Err(Error::PermissionDenied);
31	}
32
33	Ok(next.run(req).await)
34}
35
36// vim: ts=4
cloudillo_admin/perm.rs

cloudillo_admin/
perm.rs
