1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
use crate::router::{Handler, HandlerObj, ResponseFuture};
use crate::web::response;
use futures::future::ok;
use hyper::header::{HeaderValue, AUTHORIZATION, WWW_AUTHENTICATE};
use hyper::{Body, Request, Response, StatusCode};
use ring::constant_time::verify_slices_are_equal;
lazy_static! {
pub static ref GRIN_BASIC_REALM: HeaderValue =
HeaderValue::from_str("Basic realm=GrinAPI").unwrap();
}
pub struct BasicAuthMiddleware {
api_basic_auth: String,
basic_realm: &'static HeaderValue,
ignore_uri: Option<String>,
}
impl BasicAuthMiddleware {
pub fn new(
api_basic_auth: String,
basic_realm: &'static HeaderValue,
ignore_uri: Option<String>,
) -> BasicAuthMiddleware {
BasicAuthMiddleware {
api_basic_auth,
basic_realm,
ignore_uri,
}
}
}
impl Handler for BasicAuthMiddleware {
fn call(
&self,
req: Request<Body>,
mut handlers: Box<dyn Iterator<Item = HandlerObj>>,
) -> ResponseFuture {
let next_handler = match handlers.next() {
Some(h) => h,
None => return response(StatusCode::INTERNAL_SERVER_ERROR, "no handler found"),
};
if req.method().as_str() == "OPTIONS" {
return next_handler.call(req, handlers);
}
if let Some(u) = self.ignore_uri.as_ref() {
if req.uri().path() == u {
return next_handler.call(req, handlers);
}
}
if req.headers().contains_key(AUTHORIZATION)
&& verify_slices_are_equal(
req.headers()[AUTHORIZATION].as_bytes(),
&self.api_basic_auth.as_bytes(),
)
.is_ok()
{
next_handler.call(req, handlers)
} else {
unauthorized_response(&self.basic_realm)
}
}
}
fn unauthorized_response(basic_realm: &HeaderValue) -> ResponseFuture {
let response = Response::builder()
.status(StatusCode::UNAUTHORIZED)
.header(WWW_AUTHENTICATE, basic_realm)
.body(Body::empty())
.unwrap();
Box::new(ok(response))
}