nestforge 1.9.0

NestJS-inspired modular backend framework for Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153

use nestforge::{
    controller, routes, AuthIdentity, Container, ExceptionFilter, ModuleDefinition,
    NestForgeFactory, RequestContext,
};
use tower::ServiceExt;

#[controller("/admin")]
struct AdminController;

#[derive(Default)]
struct RewriteForbiddenFilter;

#[routes]
#[authenticated]
#[roles("admin")]
impl AdminController {
    #[nestforge::get("/dashboard")]
    async fn dashboard() -> nestforge::ApiResult<String> {
        Ok(axum::Json("ok".to_string()))
    }
}

impl ExceptionFilter for RewriteForbiddenFilter {
    fn catch(
        &self,
        exception: nestforge::HttpException,
        _ctx: &RequestContext,
    ) -> nestforge::HttpException {
        if exception.status == axum::http::StatusCode::FORBIDDEN {
            nestforge::HttpException::forbidden("filtered forbidden")
                .with_optional_request_id(exception.request_id)
        } else {
            exception
        }
    }
}

#[controller("/filtered")]
struct FilteredController;

#[routes]
#[use_exception_filter(RewriteForbiddenFilter)]
impl FilteredController {
    #[nestforge::get("/deny")]
    async fn deny() -> nestforge::ApiResult<String> {
        Err(nestforge::HttpException::forbidden("original forbidden"))
    }
}

struct AppModule;

impl ModuleDefinition for AppModule {
    fn register(_container: &Container) -> anyhow::Result<()> {
        Ok(())
    }

    fn controllers() -> Vec<axum::Router<Container>> {
        vec![
            <AdminController as nestforge::ControllerDefinition>::router(),
            <FilteredController as nestforge::ControllerDefinition>::router(),
        ]
    }
}

#[tokio::test]
async fn controller_level_authenticated_metadata_enforces_runtime_guards() {
    let app = NestForgeFactory::<AppModule>::create()
        .expect("factory should build")
        .into_router();

    let response = app
        .oneshot(
            axum::http::Request::builder()
                .uri("/admin/dashboard")
                .body(axum::body::Body::empty())
                .expect("request should build"),
        )
        .await
        .expect("request should succeed");

    assert_eq!(response.status(), axum::http::StatusCode::UNAUTHORIZED);
}

#[tokio::test]
async fn controller_level_roles_metadata_enforces_role_checks() {
    let app = NestForgeFactory::<AppModule>::create()
        .expect("factory should build")
        .with_auth_resolver(|token, _container| async move {
            Ok(token.map(|_| AuthIdentity::new("demo-user").with_roles(["viewer"])))
        })
        .into_router();

    let response = app
        .oneshot(
            axum::http::Request::builder()
                .uri("/admin/dashboard")
                .header(axum::http::header::AUTHORIZATION, "Bearer demo-token")
                .body(axum::body::Body::empty())
                .expect("request should build"),
        )
        .await
        .expect("request should succeed");

    assert_eq!(response.status(), axum::http::StatusCode::FORBIDDEN);
}

#[tokio::test]
async fn controller_level_roles_metadata_allows_matching_roles() {
    let app = NestForgeFactory::<AppModule>::create()
        .expect("factory should build")
        .with_auth_resolver(|token, _container| async move {
            Ok(token.map(|_| AuthIdentity::new("demo-user").with_roles(["admin"])))
        })
        .into_router();

    let response = app
        .oneshot(
            axum::http::Request::builder()
                .uri("/admin/dashboard")
                .header(axum::http::header::AUTHORIZATION, "Bearer demo-token")
                .body(axum::body::Body::empty())
                .expect("request should build"),
        )
        .await
        .expect("request should succeed");

    assert_eq!(response.status(), axum::http::StatusCode::OK);
}

#[tokio::test]
async fn controller_level_exception_filters_rewrite_route_failures() {
    let app = NestForgeFactory::<AppModule>::create()
        .expect("factory should build")
        .into_router();

    let response = app
        .oneshot(
            axum::http::Request::builder()
                .uri("/filtered/deny")
                .body(axum::body::Body::empty())
                .expect("request should build"),
        )
        .await
        .expect("request should succeed");

    assert_eq!(response.status(), axum::http::StatusCode::FORBIDDEN);
    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
        .await
        .expect("response body should read");
    let payload: serde_json::Value =
        serde_json::from_slice(&body).expect("response body should be json");
    assert_eq!(payload["message"], "filtered forbidden");
}