nestrs 0.3.8

NestJS-like API framework for Rust on top of Axum and Tower.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110

//! Controller-level `controller_guards(...)` run **outside** per-route guards (NestJS order).

use axum::body::{to_bytes, Body};
use axum::http::request::Parts;
use axum::http::{Request, StatusCode};
use nestrs::prelude::*;
use tower::util::ServiceExt;

#[derive(Default)]
#[injectable]
struct AppState;

#[derive(Default)]
struct CtrlDenyGuard;

#[async_trait]
impl CanActivate for CtrlDenyGuard {
    async fn can_activate(&self, _parts: &Parts) -> Result<(), GuardError> {
        Err(GuardError::forbidden("ctrl-deny"))
    }
}

#[derive(Default)]
struct RouteDenyGuard;

#[async_trait]
impl CanActivate for RouteDenyGuard {
    async fn can_activate(&self, _parts: &Parts) -> Result<(), GuardError> {
        Err(GuardError::forbidden("route-deny"))
    }
}

#[controller(prefix = "/c", version = "v1")]
struct CtrlDenyController;

impl CtrlDenyController {
    #[get("/")]
    async fn root() -> &'static str {
        "should-not-run"
    }
}

impl_routes!(CtrlDenyController, state AppState, controller_guards(CtrlDenyGuard) => [
    GET "/" with () => CtrlDenyController::root,
]);

#[controller(prefix = "/c", version = "v1")]
struct OrderProbeController;

impl OrderProbeController {
    #[get("/order")]
    async fn order() -> &'static str {
        "should-not-run"
    }
}

impl_routes!(OrderProbeController, state AppState, controller_guards(CtrlDenyGuard) => [
    GET "/order" with (RouteDenyGuard) => OrderProbeController::order,
]);

#[module(controllers = [CtrlDenyController], providers = [AppState])]
struct CtrlDenyModule;

#[module(controllers = [OrderProbeController], providers = [AppState])]
struct OrderProbeModule;

#[tokio::test]
async fn controller_guard_blocks_all_routes() {
    let router = NestFactory::create::<CtrlDenyModule>().into_router();

    let response = router
        .oneshot(
            Request::builder()
                .uri("/v1/c")
                .method("GET")
                .body(Body::empty())
                .expect("valid"),
        )
        .await
        .expect("serve");

    assert_eq!(response.status(), StatusCode::FORBIDDEN);
    let bytes = to_bytes(response.into_body(), 4096).await.expect("body");
    let v: serde_json::Value = serde_json::from_slice(&bytes).expect("json");
    assert_eq!(v["message"], "ctrl-deny");
}

#[tokio::test]
async fn controller_guards_are_outer_relative_to_route_guards() {
    let router = NestFactory::create::<OrderProbeModule>().into_router();

    let response = router
        .oneshot(
            Request::builder()
                .uri("/v1/c/order")
                .method("GET")
                .body(Body::empty())
                .expect("valid"),
        )
        .await
        .expect("serve");

    assert_eq!(response.status(), StatusCode::FORBIDDEN);
    let bytes = to_bytes(response.into_body(), 4096).await.expect("body");
    let v: serde_json::Value = serde_json::from_slice(&bytes).expect("json");
    assert_eq!(
        v["message"], "ctrl-deny",
        "when both deny, outer (controller) guard must run first"
    );
}