pubky-homeserver 0.12.0

A Pubky homeserver implementation.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

//! Auth router constructors.
//!
//! The auth module provides two routers:
//! - [`base_router`]: Unauthenticated routes (signup, session creation).
//! - [`tenant_router`]: Authenticated session management routes.
//!
//! Cookie and grant routes are fully separated — each has its own URL namespace
//! and its own auth-method-specific middleware.

use axum::{
    routing::{delete, get, post},
    Router,
};

use super::cookie;
use super::grant;
use crate::client_server::auth::AuthState;

/// Base-level auth routes — no authentication middleware.
///
/// These are entry points for creating sessions:
/// - `POST /signup` — cookie-based user creation (deprecated)
/// - `POST /session` — cookie-based signin (deprecated)
/// - `POST /auth/grant/session` — grant-based session creation
pub fn base_router(auth_state: AuthState) -> Router<()> {
    Router::new()
        // Cookie (deprecated)
        .route("/signup", post(cookie::routes::signup))
        .route("/session", post(cookie::routes::signin))
        // Grant
        .route("/auth/grant/signup", post(grant::routes::signup))
        .route(
            "/auth/grant/session",
            post(grant::routes::create_grant_session),
        )
        .with_state(auth_state)
}

/// Tenant-level auth routes — with per-method authentication middleware.
///
/// Global authentication resolves credentials into `AuthSession`; handlers
/// enforce whether they accept cookie or grant sessions.
pub fn tenant_router(auth_state: AuthState) -> Router<()> {
    let cookie_routes = Router::new().route(
        "/session",
        get(cookie::routes::get_session).delete(cookie::routes::signout),
    );

    let grant_routes = Router::new()
        .route(
            "/auth/grant/session",
            get(grant::routes::get_session).delete(grant::routes::signout),
        )
        .route("/auth/grant/sessions", get(grant::routes::list_grants))
        .route(
            "/auth/grant/session/{gid}",
            delete(grant::routes::revoke_grant),
        );

    cookie_routes.merge(grant_routes).with_state(auth_state)
}