josecelano
commented
3 months ago Hi @mario-nt, I think after implementing this issue, we should make sure all handlers call the authorization service directly or inside the application services. It would be better if we create an application service for all handlers.
Examples
Handlers without authorization:
#[allow(clippy::unused_async)]
pub async fn about_page_handler(State(_app_data): State<Arc<AppData>>) -> Response {
(
StatusCode::OK,
[(header::CONTENT_TYPE, "text/html; charset=utf-8")],
about::page(),
)
.into_response()
}pub async fn license_page_handler(State(_app_data): State<Arc<AppData>>) -> Response {
(
StatusCode::OK,
[(header::CONTENT_TYPE, "text/html; charset=utf-8")],
about::license_page(),
)
.into_response()
}pub async fn get_all_handler(State(app_data): State<Arc<AppData>>) -> Response {
match app_data.category_repository.get_all().await {
Ok(categories) => {
let categories: Vec<Category> = categories.into_iter().map(Category::from).collect();
Json(responses::OkResponseData { data: categories }).into_response()
}
Err(error) => error.into_response(),
}
}In fact, there are a lot of them, including all the public endpoints and those that only require a user to be logged in. Even if they don't not require a specific role or conditions we should include them in the authorization service to make the permission explicit in the list.
mario-nt
da2ce7
Casbin is a powerful library for implementing authorization.
Using Casbin as an authorization layer would make the code cleaner and easier to work with, also, it will allow us to implement several authorization patterns like role based authorization and attribute based authorization with ease.
The idea is to refactor the authorization service and implement Casbin for the authorization logic.
Subtasks