runique 1.1.25

A Django-inspired web framework for Rust with ORM, templates, and comprehensive security middleware
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

use crate::forms::extractor::Prisme;
use crate::forms::field::RuniqueForm;
use crate::utils::aliases::{StrMap, StrVecMap};
use crate::utils::constante::CSRF_TOKEN_KEY;
use axum::response::Response;
use std::collections::HashMap;
use std::sync::Arc;
use tera::Tera;

/// CSRF gate : vérification du token dans les données parsées.
/// Retourne Some(Prisme) si invalid/missing (formulaire vide avec erreur), None sinon.
pub async fn csrf_gate<T: RuniqueForm>(
    parsed: &StrVecMap,
    csrf_session: &str,
    tera: Arc<Tera>,
) -> Result<Option<Prisme<T>>, Response> {
    let csrf_submitted = parsed
        .get(CSRF_TOKEN_KEY)
        .and_then(|v| v.last())
        .map(|s| s.as_str());

    if csrf_submitted != Some(csrf_session) {
        let empty: StrMap = HashMap::new();
        let mut form = T::build_with_data(&empty, tera.clone(), csrf_session).await;
        form.get_form_mut().set_tera(tera);
        if let Some(csrf_field) = form.get_form_mut().fields.get_mut(CSRF_TOKEN_KEY) {
            csrf_field.set_error("Token CSRF invalide ou manquant".to_string());
        }
        return Ok(Some(Prisme(form)));
    }

    Ok(None)
}