v0.1.0

src/auth/middleware.rs

@@ -10,7 +10,8 @@ use super::session::SessionStore;
 pub const BROWSER_COOKIE: &str = "rustbox_browser";
 pub const ACTIVE_ACCOUNT_HEADER: &str = "X-Active-Account";
 
-const UNAUTHORIZED_BODY: &str = r#"{"error":{"code":"UNAUTHORIZED","message":"Invalid or expired session","status":401}}"#;
+const UNAUTHORIZED_BODY: &str =
+    r#"{"error":{"code":"UNAUTHORIZED","message":"Invalid or expired session","status":401}}"#;
 
 fn unauthorized() -> Response {
     (
@@ -117,17 +118,21 @@ pub async fn auth_guard(mut req: Request, next: Next) -> Response {
         None => return unauthorized(),
     };
 
-    let account_id = match extract_active_account_header(&req).or_else(|| extract_active_account_query(&req)) {
-        Some(a) => a,
-        None => return unauthorized(),
-    };
+    let account_id =
+        match extract_active_account_header(&req).or_else(|| extract_active_account_query(&req)) {
+            Some(a) => a,
+            None => return unauthorized(),
+        };
 
     let token = match extract_session_cookie(&req, &account_id) {
         Some(t) => t,
         None => return account_expired(&account_id),
     };
 
-    let session = match store.get_account_session(&browser_id, &account_id, &token) {
+    let session = match store
+        .get_account_session_shared(&browser_id, &account_id, &token)
+        .await
+    {
         Some(s) => s,
         None => return account_expired(&account_id),
     };
@@ -157,7 +162,9 @@ mod tests {
 
     fn guarded_router(store: Arc<SessionStore>) -> Router {
         let handler = |Extension(session): Extension<AccountSession>| async move {
-            serde_json::json!({ "email": session.email }).to_string().into_response()
+            serde_json::json!({ "email": session.email })
+                .to_string()
+                .into_response()
         };
 
         Router::new()
@@ -166,10 +173,7 @@ mod tests {
             .layer(Extension(store))
     }
 
-    async fn send(
-        router: Router,
-        req: Request<Body>,
-    ) -> (StatusCode, serde_json::Value) {
+    async fn send(router: Router, req: Request<Body>) -> (StatusCode, serde_json::Value) {
         let resp = router.oneshot(req).await.expect("request should succeed");
         let status = resp.status();
         let bytes = resp.into_body().collect().await.unwrap().to_bytes();
@@ -184,7 +188,12 @@ mod tests {
         token: String,
     }
 
-    fn create_test_session(store: &SessionStore, email: &str, password: &str, user_hash: &str) -> TestSession {
+    fn create_test_session(
+        store: &SessionStore,
+        email: &str,
+        password: &str,
+        user_hash: &str,
+    ) -> TestSession {
         let browser_id = store.create_browser();
         let (token, account_id) = store.add_account_to_browser(
             &browser_id,
@@ -198,7 +207,11 @@ mod tests {
             587,
             true,
         );
-        TestSession { browser_id, account_id, token }
+        TestSession {
+            browser_id,
+            account_id,
+            token,
+        }
     }
 
     fn build_auth_headers(session: &TestSession) -> String {
@@ -247,7 +260,10 @@ mod tests {
         let req = Request::builder()
             .uri("/protected")
             .header(ACTIVE_ACCOUNT_HEADER, &session.account_id)
-            .header("cookie", format!("rustbox_session_{}={}", session.account_id, session.token))
+            .header(
+                "cookie",
+                format!("rustbox_session_{}={}", session.account_id, session.token),
+            )
             .body(Body::empty())
             .unwrap();
 
@@ -304,10 +320,13 @@ mod tests {
         let req = Request::builder()
             .uri("/protected")
             .header(ACTIVE_ACCOUNT_HEADER, &session.account_id)
-            .header("cookie", format!(
-                "rustbox_browser={}; rustbox_session_{}=invalid-token",
-                session.browser_id, session.account_id
-            ))
+            .header(
+                "cookie",
+                format!(
+                    "rustbox_browser={}; rustbox_session_{}=invalid-token",
+                    session.browser_id, session.account_id
+                ),
+            )
             .body(Body::empty())
             .unwrap();
 
@@ -347,10 +366,13 @@ mod tests {
         let req = Request::builder()
             .uri("/protected")
             .header(ACTIVE_ACCOUNT_HEADER, &session.account_id)
-            .header("cookie", format!(
-                "rustbox_browser={}; rustbox_session_{}={}",
-                wrong_browser_id, session.account_id, session.token
-            ))
+            .header(
+                "cookie",
+                format!(
+                    "rustbox_browser={}; rustbox_session_{}={}",
+                    wrong_browser_id, session.account_id, session.token
+                ),
+            )
             .body(Body::empty())
             .unwrap();
 
@@ -364,7 +386,7 @@ mod tests {
     #[tokio::test]
     async fn expired_session_returns_account_expired() {
         let store = Arc::new(SessionStore::new(Duration::from_millis(50)));
-        let session = create_test_session(&store.as_ref(), "bob@example.com", "pass", "hash");
+        let session = create_test_session(store.as_ref(), "bob@example.com", "pass", "hash");
 
         thread::sleep(Duration::from_millis(100));
 
@@ -418,10 +440,13 @@ mod tests {
         let req = Request::builder()
             .uri("/protected")
             .header(ACTIVE_ACCOUNT_HEADER, &session.account_id)
-            .header("cookie", format!(
-                "other_browser={}; rustbox_session_{}={}",
-                session.browser_id, session.account_id, session.token
-            ))
+            .header(
+                "cookie",
+                format!(
+                    "other_browser={}; rustbox_session_{}={}",
+                    session.browser_id, session.account_id, session.token
+                ),
+            )
             .body(Body::empty())
             .unwrap();
 
@@ -472,7 +497,10 @@ mod tests {
             .body(Body::empty())
             .unwrap();
 
-        assert_eq!(extract_active_account_header(&req), Some("account-123".to_string()));
+        assert_eq!(
+            extract_active_account_header(&req),
+            Some("account-123".to_string())
+        );
     }
 
     #[tokio::test]
@@ -492,7 +520,10 @@ mod tests {
             .body(Body::empty())
             .unwrap();
 
-        assert_eq!(extract_active_account_query(&req), Some("account-123".to_string()));
+        assert_eq!(
+            extract_active_account_query(&req),
+            Some("account-123".to_string())
+        );
     }
 
     #[tokio::test]
@@ -502,7 +533,10 @@ mod tests {
             .body(Body::empty())
             .unwrap();
 
-        assert_eq!(extract_active_account_query(&req), Some("abc@example.com".to_string()));
+        assert_eq!(
+            extract_active_account_query(&req),
+            Some("abc@example.com".to_string())
+        );
     }
 
     #[tokio::test]
@@ -543,10 +577,13 @@ mod tests {
         let req = Request::builder()
             .uri(format!("/protected?account_id={}", session2.account_id))
             .header(ACTIVE_ACCOUNT_HEADER, &session1.account_id)
-            .header("cookie", format!(
-                "rustbox_browser={}; rustbox_session_{}={}",
-                session1.browser_id, session1.account_id, session1.token
-            ))
+            .header(
+                "cookie",
+                format!(
+                    "rustbox_browser={}; rustbox_session_{}={}",
+                    session1.browser_id, session1.account_id, session1.token
+                ),
+            )
             .body(Body::empty())
             .unwrap();