PDP/pdp-server/src/api/authn_middleware.rs at 8f663285a6ab33cff5a923ac30a95cafed87fb8c · permitio/PDP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
use crate::state::AppState;
use axum::{
    body::Body,
    extract::{Request, State},
    http::StatusCode,
    middleware::Next,
    response::Response,
};
use log::warn;

pub(super) async fn authentication_middleware(
    State(state): State<AppState>,
    request: Request<Body>,
    next: Next,
) -> Response {
    // Extract the authorization header
    let auth_header = match request.headers().get(http::header::AUTHORIZATION) {
        Some(header) => header,
        None => {
            warn!("Missing Authorization header");
            // TODO avoid this expect panic (maybe using IntoResponse)
            return Response::builder()
                .status(StatusCode::UNAUTHORIZED)
                .body("Missing Authorization header".into())
                .expect("Failed to create response");
        }
    };

    // Extract the token from the authorization header
    let api_key = match auth_header.to_str() {
        Ok(header_str) if header_str.to_lowercase().starts_with("bearer ") => {
            // Remove the "Bearer " prefix
            header_str[7..].to_string()
        }
        Ok(header_str) => {
            warn!("Invalid Authorization header format, missing 'Bearer ' prefix: {header_str}");
            return Response::builder()
                .status(StatusCode::FORBIDDEN)
                .body(
                    "You are not authorized to access this resource, please check your API key."
                        .into(),
                )
                .expect("Failed to create response");
        }
        Err(e) => {
            warn!("Failed to parse Authorization header to string: {e}");
            return Response::builder()
                .status(StatusCode::FORBIDDEN)
                .body(
                    "You are not authorized to access this resource, please check your API key."
                        .into(),
                )
                .expect("Failed to create response");
        }
    };

    // Verify the API key
    if api_key != state.config.api_key {
        warn!("Authentication failed: Invalid API key");
        return Response::builder()
            .status(StatusCode::FORBIDDEN)
            .body(
                "You are not authorized to access this resource, please check your API key.".into(),
            )
            .expect("Failed to create response");
    }
    next.run(request).await
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::test_utils::TestFixture;
    use axum::routing::get;
    use axum::Router;
    use http_body_util::BodyExt;
    use tower::ServiceExt;

    const TEST_ROUTE: &str = "/test";

    /// Helper function to set up a mock app with authentication middleware
    async fn setup_authn_mock_app(api_key: &str) -> Router {
        // Create a TestFixture and get settings from it, but customize the API key
        let fixture = TestFixture::new().await;
        let mut config = fixture.config.clone();
        config.api_key = api_key.to_string();
        let state = AppState::for_testing(&config);

        Router::new()
            .route(TEST_ROUTE, get(async || (StatusCode::OK, "Authenticated")))
            .layer(axum::middleware::from_fn_with_state(
                state.clone(),
                authentication_middleware,
            ))
            .with_state(state)
    }

    /// Helper function to build a request with optional authorization header
    async fn send_request(app: &Router, auth_header: Option<&str>) -> (StatusCode, String) {
        let mut request_builder = Request::builder().uri(TEST_ROUTE);

        if let Some(auth) = auth_header {
            request_builder = request_builder.header("Authorization", auth);
        }

        let request = request_builder
            .body(Body::empty())
            .expect("Failed to build request");

        let response = app
            .clone()
            .oneshot(request)
            .await
            .expect("Failed to send request");

        let status = response.status();
        let body_bytes = response
            .into_body()
            .collect()
            .await
            .expect("Failed to read response body")
            .to_bytes();

        let body = String::from_utf8(body_bytes.to_vec())
            .expect("Failed to convert response body to string");

        (status, body)
    }

    #[tokio::test]
    async fn test_authentication_middleware() {
        let app = setup_authn_mock_app("test_api_key").await;
        let (status, body) = send_request(&app, Some("Bearer test_api_key")).await;

        assert_eq!(status, StatusCode::OK);
        assert_eq!(body, "Authenticated");
    }

    #[tokio::test]
    async fn test_missing_authorization_header() {
        let app = setup_authn_mock_app("test_api_key").await;
        let (status, body) = send_request(&app, None).await;

        assert_eq!(status, StatusCode::UNAUTHORIZED);
        assert_eq!(body, "Missing Authorization header");
    }

    #[tokio::test]
    async fn test_invalid_authorization_format() {
        let app = setup_authn_mock_app("test_api_key").await;
        let (status, body) = send_request(&app, Some("test_api_key")).await;

        assert_eq!(status, StatusCode::FORBIDDEN);
        assert_eq!(
            body,
            "You are not authorized to access this resource, please check your API key."
        );
    }

    #[tokio::test]
    async fn test_invalid_api_key() {
        let app = setup_authn_mock_app("test_api_key").await;
        let (status, body) = send_request(&app, Some("Bearer wrong_api_key")).await;

        assert_eq!(status, StatusCode::FORBIDDEN);
        assert_eq!(
            body,
            "You are not authorized to access this resource, please check your API key."
        );
    }
}