runique 3.0.2

A Django-inspired web framework for Rust with ORM, templates, and comprehensive security middleware
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

//! Centralized configuration of Runique middlewares — session, CSP, CSRF, debug errors, rate limit.

/// Centralized configuration of all Runique middlewares
///
/// Note: CSRF is ALWAYS enabled (imposed by the framework for security)
///
/// ## Error page management
/// `enable_debug_errors` controls whether the `error_handler` middleware is added to the router.
/// When active, error pages are rendered by Tera:
/// - In **development** (`DEBUG=true` or `cargo build` without `--release`): full traces.
/// - In **production** (`cargo build --release`): clean 404/500 pages without traces.
///
use serde::{Deserialize, Serialize};

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct MiddlewareConfig {
    /// Enables `Host` header validation against the allowed hosts list.
    pub enable_host_validation: bool,
    /// Enables `error_handler` middleware which intercepts 4xx/5xx errors.
    /// Disable only if you handle errors manually in each handler.
    pub enable_debug_errors: bool,
    /// Enables the HTTP cache middleware.
    pub enable_cache: bool,
    /// When `true`, a new login invalidates the user's other active sessions
    /// (only one device connected at a time).
    pub exclusive_login: bool,
}

impl Default for MiddlewareConfig {
    fn default() -> Self {
        Self {
            enable_host_validation: true,
            enable_debug_errors: true,
            enable_cache: true,
            exclusive_login: false,
        }
    }
}

impl MiddlewareConfig {
    /// Builds a config from the environment, with host validation left
    /// disabled (configured only through the builder). The HTTP cache follows
    /// `DEBUG`: off in debug (no-cache headers), on otherwise.
    pub fn from_env() -> Self {
        Self {
            // Host validation configured only via the builder
            enable_host_validation: false,
            enable_debug_errors: true, // always mounted — config.debug handles content
            enable_cache: !crate::utils::config::env::debug_from(
                std::env::var("DEBUG").ok().as_deref(),
            ),
            exclusive_login: false,
        }
    }

    /// Configuration for production (maximum security)
    pub fn production() -> Self {
        Self {
            enable_host_validation: true,
            enable_debug_errors: true,
            enable_cache: true,
            exclusive_login: false,
        }
    }

    /// Configuration for development (more permissive)
    pub fn development() -> Self {
        Self {
            enable_host_validation: false,
            enable_debug_errors: true,
            enable_cache: false,
            exclusive_login: false,
        }
    }

    /// Configuration for API (minimal)
    pub fn api() -> Self {
        Self {
            enable_host_validation: true,
            enable_debug_errors: true,
            enable_cache: true,
            exclusive_login: false,
        }
    }

    /// Builder pattern for customization
    pub fn custom() -> Self {
        Self::default()
    }

    // Chainable methods for fine-grained configuration

    /// Enables or disables debug error pages (4xx/5xx intercepted by `error_handler`).
    #[must_use]
    pub fn with_debug_errors(mut self, enable: bool) -> Self {
        self.enable_debug_errors = enable;
        self
    }

    /// Enables or disables the HTTP cache middleware.
    #[must_use]
    pub fn with_cache(mut self, enable: bool) -> Self {
        self.enable_cache = enable;
        self
    }
}