Module middleware 

Built-in middleware. Each piece is an async function with the signature async fn(Request, Next) -> Result<Response>. Drop any of them into Router::middleware(...) in whatever order you want.

Structs

CorrelationId

Wrapper carried in the request context so handlers can pull it out via req.ctx().get::<CorrelationId>(). The inner string is the UUID rendered in hyphenated lowercase form.

CsrfGuard

A value a handler can pull out of the request context to embed in a rendered form. Lightweight; just wraps a string.

Locale

Wrapper carried in the request context so handlers can pull the negotiated locale out via req.ctx().get::<Locale>(). The inner string is the tag as it appeared in Accept-Language (e.g. "en", "en-US", "ar-EG"), already validated.

RateLimiter

Constants

CORRELATION_ID_HEADER

Response + request header name. Lower-case to keep parity with the HTTP/2 wire format and to match what other observability tooling (OpenTelemetry, Cloudflare, etc.) writes.

CSRF_HEADER

DEFAULT_LOCALE

Fallback locale when no header is sent, the header parses to nothing valid, or the project app didn’t mount the middleware. "en" matches the framework’s existing default strings (every label and button is currently English).

Functions

correlation_id

Middleware: attach a UUID v7 to every request, surface it in the response, and stash it in the request context for the audit pipeline to pick up.

csrf_protect

gzip

locale

Middleware: parse the inbound Accept-Language header and stash the negotiated locale in the request context. Falls back to DEFAULT_LOCALE when the header is absent or contains no valid tag. Never fails — locale negotiation is best-effort by design, and a missing or malformed header collapses to the default rather than rejecting the request.

logger

parse_accept_language

Parse an Accept-Language header value, returning the first language tag that passes the validator. Pulled out as a free function so the negotiation policy is unit-testable without a Request.

rate_limit

The middleware function. Wrap a limiter into a closure and hand it to Router::middleware(...).

security_headers