Add token based api auth

examples/demo/migration/src/m20220101_000001_users.rs

@@ -14,6 +14,7 @@ impl MigrationTrait for Migration {
             .col(uuid(Users::Pid).borrow_mut())
             .col(string_uniq(Users::Email).borrow_mut())
             .col(string(Users::Password).borrow_mut())
+            .col(string(Users::ApiKey).borrow_mut().unique_key())
             .col(string(Users::Name).borrow_mut())
             .col(string_null(Users::ResetToken).borrow_mut())
             .col(timestamp_null(Users::ResetSentAt).borrow_mut())
@@ -41,6 +42,7 @@ pub enum Users {
     Email,
     Name,
     Password,
+    ApiKey,
     ResetToken,
     ResetSentAt,
     EmailVerificationToken,

examples/demo/src/controllers/middleware/api_key.rs

@@ -0,0 +1,42 @@
+//! Axum middleware for validating API key tokens.
+
+use async_trait::async_trait;
+use axum::{
+    extract::{FromRef, FromRequestParts},
+    http::request::Parts,
+};
+use loco_rs::{app::AppContext, controller::middleware::auth, errors::Error};
+use serde::{Deserialize, Serialize};
+
+use crate::models::_entities::users;
+
+#[derive(Debug, Deserialize, Serialize)]
+// Represents the data structure for the API token.
+pub struct ApiToken {
+    pub user: users::Model,
+}
+
+#[async_trait]
+// Implementing the `FromRequestParts` trait for `ApiToken` to enable extracting it from the request.
+impl<S> FromRequestParts<S> for ApiToken
+where
+    AppContext: FromRef<S>,
+    S: Send + Sync,
+{
+    type Rejection = Error;
+
+    // Extracts `ApiToken` from the request parts.
+    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Error> {
+        // Extract API key from the request header.
+        let api_key = auth::extract_token_from_header(&parts.headers)
+            .map_err(|e| Error::Unauthorized(e.to_string()))?;
+
+        // Convert the state reference to the application context.
+        let state: AppContext = AppContext::from_ref(state);
+
+        // Retrieve user information based on the API key from the database.
+        let user = users::Model::find_by_api_key(&state.db, &api_key).await?;
+
+        Ok(Self { user })
+    }
+}

examples/demo/src/controllers/middleware/mod.rs

@@ -0,0 +1 @@
+pub mod api_key;

examples/demo/src/controllers/mod.rs

@@ -1,3 +1,4 @@
 pub mod auth;
+pub mod middleware;
 pub mod notes;
 pub mod user;

examples/demo/src/controllers/user.rs

@@ -1,12 +1,22 @@
-use loco_rs::prelude::*;
-
+use crate::controllers::middleware::api_key::ApiToken;
 use crate::{models::_entities::users, views::user::CurrentResponse};
+use loco_rs::prelude::*;
 
 async fn current(auth: auth::JWT, State(ctx): State<AppContext>) -> Result<Json<CurrentResponse>> {
     let user = users::Model::find_by_pid(&ctx.db, &auth.claims.pid).await?;
     format::json(CurrentResponse::new(&user))
 }
 
+async fn current_by_api_key(
+    auth: ApiToken,
+    State(_ctx): State<AppContext>,
+) -> Result<Json<CurrentResponse>> {
+    format::json(CurrentResponse::new(&auth.user))
+}
+
 pub fn routes() -> Routes {
-    Routes::new().prefix("user").add("/current", get(current))
+    Routes::new()
+        .prefix("user")
+        .add("/current", get(current))
+        .add("/current_api_key", get(current_by_api_key))
 }

examples/demo/src/fixtures/users.yaml

@@ -3,13 +3,15 @@
   pid: 11111111-1111-1111-1111-111111111111
   email: [email protected]
   password: "$argon2id$v=19$m=19456,t=2,p=1$JkBeJfBWoNlj4D684c568g$bKRQ+Ud8qwYGIaAu+x+4flGHPS4WJh3ylUUV4sEtDBY"
+  api_key: lo-95ec80d7-cb60-4b70-9b4b-9ef74cb88758
   name: user1
   created_at: "2023-11-12T12:34:56.789"
   updated_at: "2023-11-12T12:34:56.789"
 - id: 2
   pid: 22222222-2222-2222-2222-222222222222
   email: [email protected]
   password: "$argon2id$v=19$m=19456,t=2,p=1$JkBeJfBWoNlj4D684c568g$bKRQ+Ud8qwYGIaAu+x+4flGHPS4WJh3ylUUV4sEtDBY"
+  api_key: lo-153561ca-fa84-4e1b-813a-c62526d0a77e
   name: user2
   created_at: "2023-11-12T12:34:56.789"
   updated_at: "2023-11-12T12:34:56.789"

examples/demo/src/models/_entities/users.rs

@@ -15,6 +15,8 @@ pub struct Model {
     #[sea_orm(unique)]
     pub email: String,
     pub password: String,
+    #[sea_orm(unique)]
+    pub api_key: String,
     pub name: String,
     pub reset_token: Option<String>,
     pub reset_sent_at: Option<DateTime>,

examples/demo/src/models/users.rs

@@ -52,6 +52,7 @@ impl ActiveModelBehavior for super::_entities::users::ActiveModel {
             if insert {
                 let mut this = self;
                 this.pid = ActiveValue::Set(Uuid::new_v4());
+                this.api_key = ActiveValue::Set(format!("lo-{}", Uuid::new_v4()));
                 Ok(this)
             } else {
                 Ok(self)
@@ -117,6 +118,19 @@ impl super::_entities::users::Model {
         user.ok_or_else(|| ModelError::EntityNotFound)
     }
 
+    /// finds a user by the provided api key
+    ///
+    /// # Errors
+    ///
+    /// When could not find user by the given token or DB query error
+    pub async fn find_by_api_key(db: &DatabaseConnection, api_key: &str) -> ModelResult<Self> {
+        let user = users::Entity::find()
+            .filter(users::Column::ApiKey.eq(api_key))
+            .one(db)
+            .await?;
+        user.ok_or_else(|| ModelError::EntityNotFound)
+    }
+
     /// Verifies whether the provided plain password matches the hashed password
     pub fn verify_password(&self, password: &str) -> bool {
         hash::verify_password(password, &self.password)

examples/demo/tests/cmd/cli.trycmd

@@ -91,5 +91,6 @@ $ blo-cli routes
 [DELETE] /notes/:id
 [POST] /notes/:id
 [GET] /user/current
+[GET] /user/current_api_key
 
 ```

examples/demo/tests/models/snapshots/can_create_with_password@users.snap

@@ -10,6 +10,7 @@ Ok(
         pid: PID,
         email: "[email protected]",
         password: "PASSWORD",
+        api_key: "lo-PID",
         name: "framework",
         reset_token: None,
         reset_sent_at: None,

examples/demo/tests/models/snapshots/can_find_by_email@users.snap

@@ -10,6 +10,7 @@ Ok(
         pid: 11111111-1111-1111-1111-111111111111,
         email: "[email protected]",
         password: "$argon2id$v=19$m=19456,t=2,p=1$JkBeJfBWoNlj4D684c568g$bKRQ+Ud8qwYGIaAu+x+4flGHPS4WJh3ylUUV4sEtDBY",
+        api_key: "lo-95ec80d7-cb60-4b70-9b4b-9ef74cb88758",
         name: "user1",
         reset_token: None,
         reset_sent_at: None,

examples/demo/tests/models/snapshots/can_find_by_pid@users.snap

@@ -10,6 +10,7 @@ Ok(
         pid: 11111111-1111-1111-1111-111111111111,
         email: "[email protected]",
         password: "$argon2id$v=19$m=19456,t=2,p=1$JkBeJfBWoNlj4D684c568g$bKRQ+Ud8qwYGIaAu+x+4flGHPS4WJh3ylUUV4sEtDBY",
+        api_key: "lo-95ec80d7-cb60-4b70-9b4b-9ef74cb88758",
         name: "user1",
         reset_token: None,
         reset_sent_at: None,

examples/demo/tests/requests/snapshots/can_get_current_user_with_api_key@auth_request.snap

@@ -0,0 +1,8 @@
+---
+source: tests/requests/user.rs
+expression: "(response.status_code(), response.text())"
+---
+(
+    200,
+    "{\"pid\":\"PID\",\"name\":\"loco\",\"email\":\"[email protected]\"}",
+)

examples/demo/tests/requests/snapshots/can_register@auth_request.snap

@@ -10,6 +10,7 @@ Ok(
         pid: PID,
         email: "[email protected]",
         password: "PASSWORD",
+        api_key: "lo-PID",
         name: "loco",
         reset_token: None,
         reset_sent_at: None,

examples/demo/tests/requests/user.rs

@@ -38,3 +38,26 @@ async fn can_get_current_user() {
     })
     .await;
 }
+
+#[tokio::test]
+#[serial]
+async fn can_get_current_user_with_api_key() {
+    configure_insta!();
+
+    testing::request::<App, _, _>(|request, ctx| async move {
+        let user_data = prepare_data::init_user_login(&request, &ctx).await;
+
+        let (auth_key, auth_value) = prepare_data::auth_header(&user_data.user.api_key);
+        let response = request
+            .get("/user/current_api_key")
+            .add_header(auth_key, auth_value)
+            .await;
+
+        with_settings!({
+            filters => testing::cleanup_user_model()
+        }, {
+            assert_debug_snapshot!((response.status_code(), response.text()));
+        });
+    })
+    .await;
+}

starters/rest-api/migration/src/m20220101_000001_users.rs

@@ -14,6 +14,7 @@ impl MigrationTrait for Migration {
             .col(uuid(Users::Pid).borrow_mut())
             .col(string_uniq(Users::Email).borrow_mut())
             .col(string(Users::Password).borrow_mut())
+            .col(string(Users::ApiKey).borrow_mut().unique_key())
             .col(string(Users::Name).borrow_mut())
             .col(string_null(Users::ResetToken).borrow_mut())
             .col(timestamp_null(Users::ResetSentAt).borrow_mut())
@@ -40,6 +41,7 @@ pub enum Users {
     Email,
     Name,
     Password,
+    ApiKey,
     ResetToken,
     ResetSentAt,
     EmailVerificationToken,

starters/rest-api/src/controllers/middleware/api_key.rs

@@ -0,0 +1,42 @@
+//! Axum middleware for validating API key tokens.
+
+use async_trait::async_trait;
+use axum::{
+    extract::{FromRef, FromRequestParts},
+    http::request::Parts,
+};
+use loco_rs::{app::AppContext, controller::middleware::auth, errors::Error};
+use serde::{Deserialize, Serialize};
+
+use crate::models::_entities::users;
+
+#[derive(Debug, Deserialize, Serialize)]
+// Represents the data structure for the API token.
+pub struct ApiToken {
+    pub user: users::Model,
+}
+
+#[async_trait]
+// Implementing the `FromRequestParts` trait for `ApiToken` to enable extracting it from the request.
+impl<S> FromRequestParts<S> for ApiToken
+where
+    AppContext: FromRef<S>,
+    S: Send + Sync,
+{
+    type Rejection = Error;
+
+    // Extracts `ApiToken` from the request parts.
+    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Error> {
+        // Extract API key from the request header.
+        let api_key = auth::extract_token_from_header(&parts.headers)
+            .map_err(|e| Error::Unauthorized(e.to_string()))?;
+
+        // Convert the state reference to the application context.
+        let state: AppContext = AppContext::from_ref(state);
+
+        // Retrieve user information based on the API key from the database.
+        let user = users::Model::find_by_api_key(&state.db, &api_key).await?;
+
+        Ok(Self { user })
+    }
+}

starters/rest-api/src/controllers/middleware/mod.rs

@@ -0,0 +1 @@
+pub mod api_key;

starters/rest-api/src/controllers/mod.rs

@@ -1,3 +1,4 @@
 pub mod auth;
+pub mod middleware;
 pub mod notes;
 pub mod user;

starters/rest-api/src/controllers/user.rs

@@ -1,12 +1,22 @@
-use loco_rs::prelude::*;
-
+use crate::controllers::middleware::api_key::ApiToken;
 use crate::{models::_entities::users, views::user::CurrentResponse};
+use loco_rs::prelude::*;
 
 async fn current(auth: auth::JWT, State(ctx): State<AppContext>) -> Result<Json<CurrentResponse>> {
     let user = users::Model::find_by_pid(&ctx.db, &auth.claims.pid).await?;
     format::json(CurrentResponse::new(&user))
 }
 
+async fn current_by_api_key(
+    auth: ApiToken,
+    State(_ctx): State<AppContext>,
+) -> Result<Json<CurrentResponse>> {
+    format::json(CurrentResponse::new(&auth.user))
+}
+
 pub fn routes() -> Routes {
-    Routes::new().prefix("user").add("/current", get(current))
+    Routes::new()
+        .prefix("user")
+        .add("/current", get(current))
+        .add("/current_api_key", get(current_by_api_key))
 }

starters/rest-api/src/fixtures/users.yaml

@@ -3,13 +3,15 @@
   pid: 11111111-1111-1111-1111-111111111111
   email: [email protected]
   password: "$argon2id$v=19$m=19456,t=2,p=1$ETQBx4rTgNAZhSaeYZKOZg$eYTdH26CRT6nUJtacLDEboP0li6xUwUF/q5nSlQ8uuc"
+  api_key: lo-95ec80d7-cb60-4b70-9b4b-9ef74cb88758
   name: user1
   created_at: "2023-11-12T12:34:56.789"
   updated_at: "2023-11-12T12:34:56.789"
 - id: 2
   pid: 22222222-2222-2222-2222-222222222222
   email: [email protected]
   password: "$argon2id$v=19$m=19456,t=2,p=1$ETQBx4rTgNAZhSaeYZKOZg$eYTdH26CRT6nUJtacLDEboP0li6xUwUF/q5nSlQ8uuc"
+  api_key: lo-153561ca-fa84-4e1b-813a-c62526d0a77e
   name: user2
   created_at: "2023-11-12T12:34:56.789"
   updated_at: "2023-11-12T12:34:56.789"

starters/rest-api/src/models/_entities/users.rs

@@ -15,6 +15,8 @@ pub struct Model {
     #[sea_orm(unique)]
     pub email: String,
     pub password: String,
+    #[sea_orm(unique)]
+    pub api_key: String,
     pub name: String,
     pub reset_token: Option<String>,
     pub reset_sent_at: Option<DateTime>,

starters/rest-api/src/models/users.rs

@@ -52,6 +52,7 @@ impl ActiveModelBehavior for super::_entities::users::ActiveModel {
             if insert {
                 let mut this = self;
                 this.pid = ActiveValue::Set(Uuid::new_v4());
+                this.api_key = ActiveValue::Set(format!("lo-{}", Uuid::new_v4()));
                 Ok(this)
             } else {
                 Ok(self)
@@ -117,6 +118,19 @@ impl super::_entities::users::Model {
         user.ok_or_else(|| ModelError::EntityNotFound)
     }
 
+    /// finds a user by the provided api key
+    ///
+    /// # Errors
+    ///
+    /// When could not find user by the given token or DB query error
+    pub async fn find_by_api_key(db: &DatabaseConnection, api_key: &str) -> ModelResult<Self> {
+        let user = users::Entity::find()
+            .filter(users::Column::ApiKey.eq(api_key))
+            .one(db)
+            .await?;
+        user.ok_or_else(|| ModelError::EntityNotFound)
+    }
+
     /// Verifies whether the provided plain password matches the hashed password
     ///
     /// # Errors

starters/rest-api/tests/models/snapshots/can_create_with_password@users.snap

@@ -10,6 +10,7 @@ Ok(
         pid: PID,
         email: "[email protected]",
         password: "PASSWORD",
+        api_key: "lo-PID",
         name: "framework",
         reset_token: None,
         reset_sent_at: None,

starters/rest-api/tests/models/snapshots/can_find_by_email@users.snap

@@ -10,6 +10,7 @@ Ok(
         pid: 11111111-1111-1111-1111-111111111111,
         email: "[email protected]",
         password: "$argon2id$v=19$m=19456,t=2,p=1$ETQBx4rTgNAZhSaeYZKOZg$eYTdH26CRT6nUJtacLDEboP0li6xUwUF/q5nSlQ8uuc",
+        api_key: "lo-95ec80d7-cb60-4b70-9b4b-9ef74cb88758",
         name: "user1",
         reset_token: None,
         reset_sent_at: None,

starters/rest-api/tests/models/snapshots/can_find_by_pid@users.snap

@@ -10,6 +10,7 @@ Ok(
         pid: 11111111-1111-1111-1111-111111111111,
         email: "[email protected]",
         password: "$argon2id$v=19$m=19456,t=2,p=1$ETQBx4rTgNAZhSaeYZKOZg$eYTdH26CRT6nUJtacLDEboP0li6xUwUF/q5nSlQ8uuc",
+        api_key: "lo-95ec80d7-cb60-4b70-9b4b-9ef74cb88758",
         name: "user1",
         reset_token: None,
         reset_sent_at: None,

starters/rest-api/tests/requests/snapshots/can_get_current_user_with_api_key@user_request.snap

@@ -0,0 +1,8 @@
+---
+source: tests/requests/user.rs
+expression: "(response.status_code(), response.text())"
+---
+(
+    200,
+    "{\"pid\":\"PID\",\"name\":\"loco\",\"email\":\"[email protected]\"}",
+)