Struct Auth 

pub struct Auth { /* private fields */ }

The auth middleware layer.

Implementations

impl Auth

pub fn config(&self) -> &AuthConfig

Get the config for this auth layer instance.

pub async fn fetch_from_url<D: DeserializeOwned>( &mut self, url: &str, headers: HeaderMap, ) -> HtsGetResult<D>

Fetch JWKS from the authorization server.

pub async fn decode_jwks( &mut self, jwks_url: &Uri, token: &str, ) -> HtsGetResult<DecodingKey>

Get a decoding key from the JWKS url.

pub fn decode_public_key(key: &[u8]) -> HtsGetResult<DecodingKey>

Decode a public key into an RSA, EdDSA or ECDSA pem-formatted decoding key.

pub fn forwarded_headers( &self, request_headers: &HeaderMap, request_extensions: Option<Value>, request_endpoint: &Endpoint, id: &str, ) -> HtsGetResult<HeaderMap>

Get the headers to send to the authorization service.

pub async fn query_authorization_service( &mut self, headers: &HeaderMap, request_extensions: Option<Value>, request_endpoint: &Endpoint, id: &str, ) -> HtsGetResult<Option<AuthorizationRestrictions>>

Query the authorization service to get the restrictions. This function validates that the authorization url is trusted in the config settings before calling the service. The claims are assumed to be valid.

pub fn validate_restrictions( restrictions: AuthorizationRestrictions, path: &str, queries: &mut [Query], suppressed_interval: bool, ) -> HtsGetResult<AuthorizationRestrictions>

Validate the restrictions, returning an error if the user is not authorized. If suppressed_interval is set then no error is returning if there is a path match but no restrictions match. Instead, as many regions as possible are returned.

pub async fn validate_jwt( &mut self, headers: &HeaderMap, ) -> HtsGetResult<TokenData<Value>>

Validate only the JWT without looking up restrictions and validating those. Returns the decoded JWT token.

pub async fn validate_authorization( &mut self, headers: &HeaderMap, path: &str, queries: &mut [Query], request_extensions: Option<Value>, endpoint: &Endpoint, ) -> HtsGetResult<Option<AuthorizationRestrictions>>

Validate the authorization flow, returning an error if the user is not authorized. This performs the following steps:

1. Finds the JWT decoding key from the config or by querying a JWKS url.
2. Validates the JWT token according to the config.
3. Queries the authorization service for restrictions based on the config or JWT claims.
4. Validates the restrictions to determine if the user is authorized.

Trait Implementations

impl Clone for Auth

fn clone(&self) -> Auth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Auth

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.