use crate::admin::AuthAdminData;
use crate::repositories::PostgresAuthUserRepository;
use platform_core::AppContext;
use platform_http::ApiOpenApiRouter;
use platform_module::{
AdminAction, AdminActionDangerLevel, AdminActionInputField, AdminActionInputSchema,
AdminDeclarativeComponent, AdminDeclarativePage, AdminDeclarativeSection,
AdminDeclarativeSurface, AdminSchema, ConsoleArea, ConsoleNavigation, ConsolePackage,
ConsoleSurface, ConsoleWorkspaceRef, EntitySchema, FieldSchema, FieldType, LinkedBinding,
LinkedHttpContribution, Module, ModuleHttpMethod, ModuleHttpRoute, ModuleManifest,
};
use std::sync::Arc;
pub const MODULE_NAME: &str = "auth";
pub const AUTH_USERS_READ: &str = "auth.users.read";
pub fn http_routes() -> Vec<ModuleHttpRoute> {
vec![
ModuleHttpRoute {
method: ModuleHttpMethod::Post,
path: "/v1/auth/dev/sessions".to_owned(),
capability: None,
display_name: Some("Create Development Session".to_owned()),
story_title: Some("Development Auth Session".to_owned()),
},
ModuleHttpRoute {
method: ModuleHttpMethod::Post,
path: "/v1/auth/sessions/revoke".to_owned(),
capability: None,
display_name: Some("Revoke Session".to_owned()),
story_title: Some("Auth Session Revoked".to_owned()),
},
]
}
pub fn user_schema() -> AdminSchema {
AdminSchema {
entities: vec![
EntitySchema {
name: "users".to_owned(),
label: "Users".to_owned(),
read_capability: AUTH_USERS_READ.to_owned(),
fields: vec![
FieldSchema {
name: "id".to_owned(),
label: "ID".to_owned(),
field_type: FieldType::String,
nullable: false,
},
FieldSchema {
name: "device_id".to_owned(),
label: "Device".to_owned(),
field_type: FieldType::String,
nullable: true,
},
FieldSchema {
name: "created_at".to_owned(),
label: "Created".to_owned(),
field_type: FieldType::Timestamp,
nullable: false,
},
FieldSchema {
name: "disabled_at".to_owned(),
label: "Disabled".to_owned(),
field_type: FieldType::Timestamp,
nullable: true,
},
FieldSchema {
name: "disabled_reason".to_owned(),
label: "Reason".to_owned(),
field_type: FieldType::String,
nullable: true,
},
FieldSchema {
name: "disabled_until".to_owned(),
label: "Until".to_owned(),
field_type: FieldType::Timestamp,
nullable: true,
},
],
},
EntitySchema {
name: "sessions".to_owned(),
label: "Sessions".to_owned(),
read_capability: AUTH_USERS_READ.to_owned(),
fields: vec![
FieldSchema {
name: "id".to_owned(),
label: "ID".to_owned(),
field_type: FieldType::String,
nullable: false,
},
FieldSchema {
name: "user_id".to_owned(),
label: "User".to_owned(),
field_type: FieldType::String,
nullable: false,
},
FieldSchema {
name: "device_id".to_owned(),
label: "Device".to_owned(),
field_type: FieldType::String,
nullable: true,
},
FieldSchema {
name: "client_ip".to_owned(),
label: "IP".to_owned(),
field_type: FieldType::String,
nullable: true,
},
FieldSchema {
name: "user_agent".to_owned(),
label: "User agent".to_owned(),
field_type: FieldType::String,
nullable: true,
},
FieldSchema {
name: "created_at".to_owned(),
label: "Created".to_owned(),
field_type: FieldType::Timestamp,
nullable: false,
},
FieldSchema {
name: "expires_at".to_owned(),
label: "Expires".to_owned(),
field_type: FieldType::Timestamp,
nullable: false,
},
FieldSchema {
name: "revoked_at".to_owned(),
label: "Revoked".to_owned(),
field_type: FieldType::Timestamp,
nullable: true,
},
],
},
],
}
}
pub fn admin_surface() -> AdminDeclarativeSurface {
AdminDeclarativeSurface {
pages: vec![AdminDeclarativePage {
name: "sessions".to_owned(),
label: "Sessions".to_owned(),
sections: vec![AdminDeclarativeSection {
name: "sessions".to_owned(),
label: "Sessions".to_owned(),
component: AdminDeclarativeComponent::EntityTable {
entity: "sessions".to_owned(),
},
}],
}],
actions: vec![
action_with_string_input(
"revoke_session",
"Revoke session",
"session_id",
"Session",
AdminActionDangerLevel::Medium,
),
disable_user_action(),
action_with_string_input(
"enable_user",
"Enable user",
"user_id",
"User",
AdminActionDangerLevel::Low,
),
],
fallback_schema: Some(user_schema()),
}
}
fn action_with_string_input(
name: &str,
label: &str,
input_name: &str,
input_label: &str,
danger_level: AdminActionDangerLevel,
) -> AdminAction {
AdminAction {
name: name.to_owned(),
label: label.to_owned(),
capability: AUTH_USERS_READ.to_owned(),
input_schema: Some(AdminActionInputSchema {
fields: vec![AdminActionInputField {
name: input_name.to_owned(),
label: input_label.to_owned(),
field_type: FieldType::String,
required: true,
description: None,
}],
}),
confirmation: None,
danger_level,
}
}
fn disable_user_action() -> AdminAction {
AdminAction {
name: "disable_user".to_owned(),
label: "Disable user".to_owned(),
capability: AUTH_USERS_READ.to_owned(),
input_schema: Some(AdminActionInputSchema {
fields: vec![
AdminActionInputField {
name: "user_id".to_owned(),
label: "User".to_owned(),
field_type: FieldType::String,
required: true,
description: None,
},
AdminActionInputField {
name: "reason".to_owned(),
label: "Reason".to_owned(),
field_type: FieldType::String,
required: false,
description: None,
},
AdminActionInputField {
name: "disabled_until".to_owned(),
label: "Until".to_owned(),
field_type: FieldType::Timestamp,
required: false,
description: Some("RFC3339 timestamp; omit for permanent".to_owned()),
},
],
}),
confirmation: None,
danger_level: AdminActionDangerLevel::Medium,
}
}
fn auth_workspace() -> ConsoleWorkspaceRef {
ConsoleWorkspaceRef {
id: "auth".to_owned(),
label: "Auth".to_owned(),
icon: Some("shield".to_owned()),
}
}
pub fn console_surfaces() -> Vec<ConsoleSurface> {
vec![
ConsoleSurface {
name: "sessions".to_owned(),
label: "Sessions".to_owned(),
area: ConsoleArea::Data,
route: "/data/auth/sessions".to_owned(),
package: ConsolePackage {
name: "@lenso/auth-console".to_owned(),
export: "authConsoleModule".to_owned(),
},
icon: Some("shield".to_owned()),
required_capabilities: vec![AUTH_USERS_READ.to_owned()],
navigation: Some(ConsoleNavigation {
workspace: auth_workspace(),
group: None,
order: Some(50),
}),
},
ConsoleSurface {
name: "users".to_owned(),
label: "Users".to_owned(),
area: ConsoleArea::Data,
route: "/data/auth/users".to_owned(),
package: ConsolePackage {
name: "@lenso/auth-console".to_owned(),
export: "authConsoleModule".to_owned(),
},
icon: Some("shield".to_owned()),
required_capabilities: vec![AUTH_USERS_READ.to_owned()],
navigation: Some(ConsoleNavigation {
workspace: auth_workspace(),
group: None,
order: Some(60),
}),
},
]
}
pub fn manifest() -> ModuleManifest {
ModuleManifest::builder(MODULE_NAME)
.capabilities(vec![AUTH_USERS_READ.to_owned()])
.http_routes(http_routes())
.declarative_admin(admin_surface())
.console(console_surfaces())
.build()
}
pub fn merge_http(base: ApiOpenApiRouter) -> ApiOpenApiRouter {
base.merge(crate::routes::router())
}
pub fn binding() -> LinkedBinding {
LinkedBinding::builder()
.http(LinkedHttpContribution {
public_prefixes: &["/v1/auth/dev/", "/v1/auth/sessions/"],
merge: merge_http,
})
.build()
}
pub fn module(ctx: &AppContext) -> Module {
let repository = Arc::new(PostgresAuthUserRepository::new(ctx.db.clone()));
let admin = Arc::new(AuthAdminData::new(repository));
Module::linked(manifest(), binding())
.with_runtime_config(crate::config::RUNTIME_CONFIG.as_slice())
.with_admin_data(admin.clone())
.with_admin_actions(admin)
}
#[cfg(test)]
mod tests {
use super::*;
use platform_module::{ModuleManifestLintSeverity, ModuleSource, lint_module_manifest};
#[test]
fn manifest_declares_auth_user_anchor() {
let manifest = manifest();
assert_eq!(manifest.name, MODULE_NAME);
assert_eq!(manifest.capabilities, vec![AUTH_USERS_READ]);
assert_eq!(manifest.http_routes, http_routes());
assert_eq!(
manifest.admin,
Some(platform_module::AdminSurface::DeclarativeCustom(
admin_surface()
))
);
assert_eq!(manifest.console, console_surfaces());
let lints = lint_module_manifest(ModuleSource::Linked, &manifest);
assert!(
lints
.iter()
.all(|lint| lint.severity == ModuleManifestLintSeverity::Ok),
"auth manifest should not have warning/error lints: {lints:?}"
);
}
}