refactor: [#727] use the Authentication header in the API client

Instead of passing the `token` via GET param.

The server supports both. Since we have not released any version crate for the
client yet we can use the header by deafault which is more secure.

Author: josecelano

packages/axum-rest-tracker-api-server/tests/server/v1/contract/authentication.rs

@@ -2,6 +2,7 @@ mod given_that_the_token_is_only_provided_in_the_authentication_header {
     use hyper::header;
     use torrust_axum_rest_tracker_api_server::environment::Started;
     use torrust_rest_tracker_api_client::common::http::Query;
+    use torrust_rest_tracker_api_client::connection_info::ConnectionInfo;
     use torrust_rest_tracker_api_client::v1::client::{
         headers_with_auth_token, headers_with_request_id, Client, AUTH_BEARER_TOKEN_HEADER_PREFIX,
     };
@@ -80,7 +81,9 @@ mod given_that_the_token_is_only_provided_in_the_authentication_header {
                 .expect("the auth token is not a valid header value"),
         );
 
-        let response = Client::new(env.get_connection_info())
+        let connection_info = ConnectionInfo::anonymous(env.get_connection_info().origin);
+
+        let response = Client::new(connection_info)
             .unwrap()
             .get_request_with_query("stats", Query::default(), Some(headers))
             .await;
@@ -99,7 +102,8 @@ mod given_that_the_token_is_only_provided_in_the_query_param {
 
     use torrust_axum_rest_tracker_api_server::environment::Started;
     use torrust_rest_tracker_api_client::common::http::{Query, QueryParam};
-    use torrust_rest_tracker_api_client::v1::client::{headers_with_request_id, Client};
+    use torrust_rest_tracker_api_client::connection_info::ConnectionInfo;
+    use torrust_rest_tracker_api_client::v1::client::{headers_with_request_id, Client, TOKEN_PARAM_NAME};
     use torrust_tracker_test_helpers::logging::logs_contains_a_line_with;
     use torrust_tracker_test_helpers::{configuration, logging};
     use uuid::Uuid;
@@ -114,9 +118,15 @@ mod given_that_the_token_is_only_provided_in_the_query_param {
 
         let token = env.get_connection_info().api_token.unwrap();
 
-        let response = Client::new(env.get_connection_info())
+        let connection_info = ConnectionInfo::anonymous(env.get_connection_info().origin);
+
+        let response = Client::new(connection_info)
             .unwrap()
-            .get_request_with_query("stats", Query::params([QueryParam::new("token", &token)].to_vec()), None)
+            .get_request_with_query(
+                "stats",
+                Query::params([QueryParam::new(TOKEN_PARAM_NAME, &token)].to_vec()),
+                None,
+            )
             .await;
 
         assert_eq!(response.status(), 200);
@@ -132,11 +142,13 @@ mod given_that_the_token_is_only_provided_in_the_query_param {
 
         let request_id = Uuid::new_v4();
 
-        let response = Client::new(env.get_connection_info())
+        let connection_info = ConnectionInfo::anonymous(env.get_connection_info().origin);
+
+        let response = Client::new(connection_info)
             .unwrap()
             .get_request_with_query(
                 "stats",
-                Query::params([QueryParam::new("token", "")].to_vec()),
+                Query::params([QueryParam::new(TOKEN_PARAM_NAME, "")].to_vec()),
                 Some(headers_with_request_id(request_id)),
             )
             .await;
@@ -159,11 +171,13 @@ mod given_that_the_token_is_only_provided_in_the_query_param {
 
         let request_id = Uuid::new_v4();
 
-        let response = Client::new(env.get_connection_info())
+        let connection_info = ConnectionInfo::anonymous(env.get_connection_info().origin);
+
+        let response = Client::new(connection_info)
             .unwrap()
             .get_request_with_query(
                 "stats",
-                Query::params([QueryParam::new("token", "INVALID TOKEN")].to_vec()),
+                Query::params([QueryParam::new(TOKEN_PARAM_NAME, "INVALID TOKEN")].to_vec()),
                 Some(headers_with_request_id(request_id)),
             )
             .await;
@@ -186,8 +200,10 @@ mod given_that_the_token_is_only_provided_in_the_query_param {
 
         let token = env.get_connection_info().api_token.unwrap();
 
+        let connection_info = ConnectionInfo::anonymous(env.get_connection_info().origin);
+
         // At the beginning of the query component
-        let response = Client::new(env.get_connection_info())
+        let response = Client::new(connection_info)
             .unwrap()
             .get_request(&format!("torrents?token={token}&limit=1"))
             .await;
@@ -210,6 +226,7 @@ mod given_that_not_token_is_provided {
 
     use torrust_axum_rest_tracker_api_server::environment::Started;
     use torrust_rest_tracker_api_client::common::http::Query;
+    use torrust_rest_tracker_api_client::connection_info::ConnectionInfo;
     use torrust_rest_tracker_api_client::v1::client::{headers_with_request_id, Client};
     use torrust_tracker_test_helpers::logging::logs_contains_a_line_with;
     use torrust_tracker_test_helpers::{configuration, logging};
@@ -225,7 +242,9 @@ mod given_that_not_token_is_provided {
 
         let request_id = Uuid::new_v4();
 
-        let response = Client::new(env.get_connection_info())
+        let connection_info = ConnectionInfo::anonymous(env.get_connection_info().origin);
+
+        let response = Client::new(connection_info)
             .unwrap()
             .get_request_with_query("stats", Query::default(), Some(headers_with_request_id(request_id)))
             .await;

packages/rest-tracker-api-client/src/v1/client.rs

@@ -92,69 +92,108 @@ impl Client {
     ///
     /// Will panic if the request can't be sent
     pub async fn post_empty(&self, path: &str, headers: Option<HeaderMap>) -> Response {
-        let builder = self
-            .client
-            .post(self.base_url(path).clone())
-            .query(&ReqwestQuery::from(self.query_with_token()));
+        let builder = self.client.post(self.base_url(path).clone());
 
         let builder = match headers {
             Some(headers) => builder.headers(headers),
             None => builder,
         };
 
+        let builder = match &self.connection_info.api_token {
+            Some(token) => builder.header(header::AUTHORIZATION, format!("{AUTH_BEARER_TOKEN_HEADER_PREFIX} {token}")),
+            None => builder,
+        };
+
         builder.send().await.unwrap()
     }
 
     /// # Panics
     ///
     /// Will panic if the request can't be sent
     pub async fn post_form<T: Serialize + ?Sized>(&self, path: &str, form: &T, headers: Option<HeaderMap>) -> Response {
-        let builder = self
-            .client
-            .post(self.base_url(path).clone())
-            .query(&ReqwestQuery::from(self.query_with_token()))
-            .json(&form);
+        let builder = self.client.post(self.base_url(path).clone()).json(&form);
 
         let builder = match headers {
             Some(headers) => builder.headers(headers),
             None => builder,
         };
 
+        let builder = match &self.connection_info.api_token {
+            Some(token) => builder.header(header::AUTHORIZATION, format!("{AUTH_BEARER_TOKEN_HEADER_PREFIX} {token}")),
+            None => builder,
+        };
+
         builder.send().await.unwrap()
     }
 
     /// # Panics
     ///
     /// Will panic if the request can't be sent
     async fn delete(&self, path: &str, headers: Option<HeaderMap>) -> Response {
-        let builder = self
-            .client
-            .delete(self.base_url(path).clone())
-            .query(&ReqwestQuery::from(self.query_with_token()));
+        let builder = self.client.delete(self.base_url(path).clone());
 
         let builder = match headers {
             Some(headers) => builder.headers(headers),
             None => builder,
         };
 
+        let builder = match &self.connection_info.api_token {
+            Some(token) => builder.header(header::AUTHORIZATION, format!("{AUTH_BEARER_TOKEN_HEADER_PREFIX} {token}")),
+            None => builder,
+        };
+
         builder.send().await.unwrap()
     }
 
+    /// # Panics
+    ///
+    /// Will panic if it can't convert the authentication token to a `HeaderValue`.
     pub async fn get_request_with_query(&self, path: &str, params: Query, headers: Option<HeaderMap>) -> Response {
-        get(self.base_url(path), Some(params), headers).await
+        match &self.connection_info.api_token {
+            Some(token) => {
+                let headers = if let Some(headers) = headers {
+                    // Headers provided -> add auth token if not already present
+
+                    if headers.get(header::AUTHORIZATION).is_some() {
+                        // Auth token already present -> use provided
+                        headers
+                    } else {
+                        let mut headers = headers;
+
+                        headers.insert(
+                            header::AUTHORIZATION,
+                            format!("{AUTH_BEARER_TOKEN_HEADER_PREFIX} {token}")
+                                .parse()
+                                .expect("the auth token is not a valid header value"),
+                        );
+
+                        headers
+                    }
+                } else {
+                    // No headers provided -> create headers with auth token
+
+                    let mut headers = HeaderMap::new();
+
+                    headers.insert(
+                        header::AUTHORIZATION,
+                        format!("{AUTH_BEARER_TOKEN_HEADER_PREFIX} {token}")
+                            .parse()
+                            .expect("the auth token is not a valid header value"),
+                    );
+
+                    headers
+                };
+
+                get(self.base_url(path), Some(params), Some(headers)).await
+            }
+            None => get(self.base_url(path), Some(params), headers).await,
+        }
     }
 
     pub async fn get_request(&self, path: &str) -> Response {
         get(self.base_url(path), None, None).await
     }
 
-    fn query_with_token(&self) -> Query {
-        match &self.connection_info.api_token {
-            Some(token) => Query::params([QueryParam::new("token", token)].to_vec()),
-            None => Query::default(),
-        }
-    }
-
     fn base_url(&self, path: &str) -> Url {
         Url::parse(&format!("{}{}{path}", &self.connection_info.origin, &self.base_path)).unwrap()
     }