irondrop 2.6.5

Drop files, not dependencies - a well tested fully featured & battle-ready server in a single Rust binary with support for indexing through 10M files.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

// SPDX-License-Identifier: MIT

//! Middleware system for request preprocessing (e.g. authentication).
//!
//! Provides a Basic Auth middleware that validates the `Authorization` header
//! when username & password are configured. If credentials are not configured
//! the middleware is a no-op.

use crate::error::AppError;
use crate::http::Request;
use base64::Engine;
use log::{debug, trace, warn};

/// Middleware trait – middlewares can inspect a request before it reaches a handler.
/// Returning `Ok(())` continues the chain; returning `Err(AppError)` aborts processing.
pub trait Middleware: Send + Sync + 'static {
    fn handle(&self, request: &Request) -> Result<(), AppError>;
}

/// Basic authentication middleware.
pub struct AuthMiddleware {
    pub username: Option<String>,
    pub password: Option<String>,
}

impl AuthMiddleware {
    pub fn new(username: Option<String>, password: Option<String>) -> Self {
        Self { username, password }
    }

    fn is_authenticated(&self, auth_header: Option<&String>) -> bool {
        let (Some(user), Some(pass)) = (&self.username, &self.password) else {
            trace!("Authentication disabled - allowing request");
            return true; // auth disabled
        };

        debug!("Authentication required - checking credentials");

        let header = match auth_header {
            Some(h) => {
                trace!("Authorization header found");
                h
            }
            None => {
                debug!("No Authorization header provided");
                return false;
            }
        };
        let credentials = match header.strip_prefix("Basic ") {
            Some(c) => {
                trace!("Basic authentication scheme detected");
                c
            }
            None => {
                debug!("Invalid authentication scheme (not Basic)");
                return false;
            }
        };
        let decoded = match base64::engine::general_purpose::STANDARD.decode(credentials) {
            Ok(d) => {
                trace!("Successfully decoded base64 credentials");
                d
            }
            Err(_) => {
                debug!("Failed to decode base64 credentials");
                return false;
            }
        };
        let decoded_str = match String::from_utf8(decoded) {
            Ok(s) => {
                trace!("Successfully converted credentials to UTF-8");
                s
            }
            Err(_) => {
                debug!("Invalid UTF-8 in decoded credentials");
                return false;
            }
        };
        if let Some((provided_user, provided_pass)) = decoded_str.split_once(':') {
            trace!("Parsed username from credentials: '{}'", provided_user);
            let auth_result = provided_user == user && provided_pass == pass;
            if auth_result {
                debug!("Authentication successful for user: '{}'", provided_user);
            } else {
                warn!("Authentication failed for user: '{}'", provided_user);
            }
            auth_result
        } else {
            debug!("Invalid credential format (missing colon separator)");
            false
        }
    }
}

impl Middleware for AuthMiddleware {
    fn handle(&self, request: &Request) -> Result<(), AppError> {
        if self.username.is_some()
            && self.password.is_some()
            && !self.is_authenticated(request.headers.get("authorization"))
        {
            return Err(AppError::Unauthorized);
        }
        Ok(())
    }
}