Crate larust_http 

Route/Router DSL over axum, plus middleware, sessions, and CSRF. Route model binding lands in a later milestone.

Re-exports

pub use axum;

Modules

csrf

locale

Locale negotiation middleware - the session-reading half of larust_lang’s own current-locale story (see that crate’s doc comment for the full design: translation files, t/t_with, the task-local scope this wraps). Opt-in, like require_auth/csrf::verify - unlike push_registry_scope, larust_lang::current_locale() already degrades correctly with no scope established at all (falls back to Config::app_locale), so there’s no “always on, unconditional” case to make for this the way there was for @push/@stack.

preferences

Long-lived, unsigned, client-writable preference cookies - backing @globals’ persist entries (persist theme = "dark", see docs/MACROS.md). Deliberately not the session cookie (session.rs): that one is scoped to the current browser session (Expiry::OnSessionEnd by default - no .with_expiry(...) call anywhere in this crate) and rotates on every login (Session::cycle_id(), see larust_auth::guard::login) - the wrong lifetime for a preference that should survive both. Also deliberately not signed/encrypted (axum_extra’s PrivateCookieJar/ SignedCookieJar): tampering with your own theme preference has no security consequence, so the Key-management complexity those add isn’t worth it here.

push_registry_scope

responsecache

Laravel’s spatie/laravel-responsecache - narrowed to its core shape, same “names/assignment split” reasoning larust-permissions’s own doc comment used for its own narrowing (see crates/larust-permissions/src/ lib.rs): this caches GET responses with a 200 status, keyed by URL, backed by larust-cache (which already owns its own table bootstrap and expiry sweep - this module adds no new table, just a value shape to store in the existing one).

session

Cookie-based sessions over tower-sessions (a real, maintained session engine - the cookie carries only an opaque session ID, actual data lives server-side in a Store, which is the standard, more secure pattern rather than shipping session contents in the cookie itself).

throttle

Laravel’s throttle middleware - a fixed-window request-rate limit, keyed by the caller’s real TCP peer address (ConnectInfo<SocketAddr>, see larust_core::Application::serve()’s into_make_service_with_connect_info wiring), never a client-supplied header like X-Forwarded-For - this framework has no “trusted proxy” concept to validate such a header against, so trusting it would make the limiter trivially bypassable (a different value per request) while looking like it works.

Structs

Request

Route

Static entry points matching Laravel’s Route::get(...) call sites. Each returns a Router so further routes/names can be chained the same way Laravel chains ->name(...) off a single registration.

RouteInfo

Metadata about a single registered route, independent of the underlying axum machinery - used by Router::routes() for introspection (e.g. xr route:list).

Router

The route builder. Accumulates entries by value through a fluent chain and converts to a real axum::Router via Router::into_axum_router.

Traits

Plugin

A bundle of routes a crate contributes to an app’s router - Larust’s answer to “package/plugin system,” the last unshipped item from the project’s own original v0.3 roadmap. Not a runtime registry (there’s no way to justify one for a compiled language with no dynamic loading, and this codebase already repeatedly rejects that shape elsewhere - see Policy<U>/authorize()’s own stance against a Gate-style registry, and larust-socialite’s doc comment explicitly disclaiming an extend()-style provider registry). Any crate, first-party or third-party, implements this for its own type and hands it to Router::plugin; the compiler verifies the whole thing at the call site.

Functions

random_hex

byte_len cryptographically-strong random bytes, hex-encoded - for anywhere a short, unpredictable, URL/filename-safe token is needed (a CSRF token, a generated upload filename) but a full uuid dependency would be overkill for. rand is already a dependency of this crate for exactly this reason.

resolve_route_name

Resolves a named route to its declared path (Laravel-style {param} placeholders are left unsubstituted - parameter binding lands in a later milestone).