Struct Sessions 

pub struct Sessions<St, S = Uuid> { /* private fields */ }

Available on crate feature axum only.

Login, logout and step-up for handlers: the guard, the request’s ClientContext and the session cookie it carries, in one extractor.

It takes the guard from the router state (anything with FromRef for Guard<St, S>, including the guard itself) and needs ConnectInfo<SocketAddr> like the layer; without it the request fails closed with MissingConnectInfo. It does not authenticate anything, so put step-up routes outside the GuardLayer: the layer would answer step_up_required before the handler runs.

Every result converts into a response: NewSession and IssuedToken set the cookie, LoggedOut deletes it, and GuardError and StepUpError become the matching error. Verifying credentials, and rate limiting the routes that do, stays with the app.

use std::net::SocketAddr;

use axum::{Router, http::StatusCode, routing::post};
use session_guard::{
    Guard, GuardError, IssuedToken, MemoryStore, NewSession,
    axum::{LoggedOut, Sessions, StepUpError},
};
use uuid::Uuid;

// Stands in for the app's own credential check.
async fn verify() -> Uuid {
    Uuid::nil()
}

async fn login(sessions: Sessions<MemoryStore>) -> Result<(NewSession, StatusCode), GuardError> {
    let user = verify().await;
    Ok((sessions.login(&user).await?, StatusCode::NO_CONTENT))
}

async fn step_up(sessions: Sessions<MemoryStore>) -> Result<(IssuedToken, StatusCode), StepUpError> {
    let user = verify().await;
    Ok((sessions.complete_step_up(&user).await?, StatusCode::NO_CONTENT))
}

async fn logout(sessions: Sessions<MemoryStore>) -> Result<(LoggedOut, StatusCode), GuardError> {
    Ok((sessions.logout().await?, StatusCode::NO_CONTENT))
}

let guard = Guard::new(MemoryStore::new());
let app = Router::new()
    .route("/login", post(login))
    .route("/step-up", post(step_up))
    .route("/logout", post(logout))
    .with_state(guard);
let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await?;
axum::serve(listener, app.into_make_service_with_connect_info::<SocketAddr>()).await

Implementations

impl<St: SessionStore, S: Subject> Sessions<St, S>

pub async fn login(&self, subject: &S) -> Result<NewSession, GuardError>

Guard::login for subject, revoking the session the request presented, if any. Call it only after verifying the subject’s credentials.

Errors

As Guard::login.

pub async fn logout(&self) -> Result<LoggedOut, GuardError>

Guard::logout for the presented session. The result deletes the cookie even when there was no session to revoke.

Errors

As Guard::logout.

pub async fn complete_step_up( &self, verified_subject: &S, ) -> Result<IssuedToken, StepUpError>

Guard::complete_step_up for the presented session, once the app has verified verified_subject’s credentials again.

Errors

A StepUpError: the subject does not own the session, there is no live session (including no cookie at all), or the guard failed.

pub fn guard(&self) -> &Guard<St, S>

The guard, for anything else (listing or revoking sessions).

pub fn client(&self) -> &ClientContext

The request’s client context.

pub fn token(&self) -> Option<&str>

The session cookie’s value, if the request carried one. Not validated.

Trait Implementations

impl<St, S> Debug for Sessions<St, S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T, St, S> FromRequestParts<T> for Sessions<St, S>

where T: Send + Sync, Guard<St, S>: FromRef<T>, St: SessionStore, S: Subject,

type Rejection = MissingConnectInfo

If the extractor fails it’ll use this “rejection” type. A rejection is a kind of error that can be converted into a response.

fn from_request_parts( parts: &mut Parts, state: &T, ) -> impl Future<Output = Result<Self, Self::Rejection>> + Send

Perform the extraction.

impl<St, S> OperationInput for Sessions<St, S>

Available on crate feature aide only.

fn operation_input(ctx: &mut GenContext, operation: &mut Operation)

Modify the operation.

fn inferred_early_responses( ctx: &mut GenContext, operation: &mut Operation, ) -> Vec<(Option<u16>, Response)>

Inferred early responses are used to document early returns for extractors, guards inside handlers. For example these could represent JSON parsing errors, authentication failures.