Authentication

#[async_trait]
pub trait Authentication: Send + Sync + 'static {
    async fn authenticate(&self, headers: &HeaderMap) -> Option<Identity>;
}

pub struct Identity {
    pub user_id: String,      // the authenticated user's PK, stringified (PK-type-agnostic)
    pub is_staff: bool,       // staff flag, gates admin access
    pub is_superuser: bool,   // superuser flag, grants all permissions
    pub extras: HashMap<String, Value>,  // app-specific (roles, org id, scopes)
}

Identity::user(user.id).with_staff(user.is_staff)
Identity::user(user.id).staff()                       // shorthand for .with_staff(true)
Identity::user(user.id).with_superuser(user.is_superuser)
Identity::user(user.id).with_extra("org_id", json!(42))

use umbral::prelude::*;
use umbral_auth::SessionAuthentication;
use umbral_rest::RestPlugin;
use umbral_sessions::SessionsPlugin;
 
App::builder()
    .plugin(SessionsPlugin::default())
    .plugin(RestPlugin::default().authenticate(SessionAuthentication::default()))
    .build()?;

use umbral_auth::{AuthToken, BearerAuthentication};
use umbral_rest::RestPlugin;
 
// Wire the auth class.
RestPlugin::default().authenticate(BearerAuthentication::default());
 
// Mint a token elsewhere (an admin action, an `umbral` CLI command,
// a /auth/token endpoint; the last is on the roadmap).
let (_token, plaintext) = AuthToken::create_for(&user, "laptop").await?;
println!("Save this: {plaintext}");   // shown ONCE; not recoverable from the row

curl -H "Authorization: Bearer umbral_K3PqJ4nMr9X2v..." https://api.example.com/api/article/

use std::sync::Arc;
use umbral_auth::{BearerAuthentication, SessionAuthentication};
use umbral_rest::{ChainAuthentication, RestPlugin};
 
let auth = ChainAuthentication::new(vec![
    Arc::new(SessionAuthentication::default()),
    Arc::new(BearerAuthentication::default()),
]);
RestPlugin::default().authenticate(auth);

use umbral::web::HeaderMap;
use umbral_rest::{FnAuthentication, Identity, RestPlugin, parse_basic_credentials};
 
// HTTP Basic Auth against umbral-auth:
RestPlugin::default().authenticate(FnAuthentication::new(|headers: HeaderMap| async move {
    let (user, pass) = parse_basic_credentials(&headers)?;
    let auth_user = umbral_auth::authenticate(&user, &pass).await.ok()?;
    Some(Identity::user(auth_user.id).with_staff(auth_user.is_staff))
}));

use async_trait::async_trait;
use std::collections::HashMap;
use std::sync::Arc;
use umbral::web::HeaderMap;
use umbral_rest::{Authentication, Identity, RestPlugin};
 
#[derive(Debug, Clone)]
pub struct ApiKeyAuthentication {
    // key -> (user_id, is_staff). Production code would load this
    // from settings; the example carries it inline.
    keys: Arc<HashMap<String, (i64, bool)>>,
}
 
impl ApiKeyAuthentication {
    pub fn new(keys: HashMap<String, (i64, bool)>) -> Self {
        Self { keys: Arc::new(keys) }
    }
}
 
#[async_trait]
impl Authentication for ApiKeyAuthentication {
    async fn authenticate(&self, headers: &HeaderMap) -> Option<Identity> {
        let key = headers.get("x-api-key")?.to_str().ok()?;
        let (user_id, is_staff) = self.keys.get(key).copied()?;
        Some(Identity::user(user_id).with_staff(is_staff))
    }
}
 
// Wire it:
let mut keys = HashMap::new();
keys.insert("svc_billing_d8b3...".into(), (1, true));
keys.insert("svc_metrics_a91c...".into(), (2, false));
RestPlugin::default().authenticate(ApiKeyAuthentication::new(keys));

use umbral::web::Json;
use umbral_auth::{CurrentIdentity, OptionalIdentity};
 
// Rejects with 401 if no auth resolves:
async fn dashboard(CurrentIdentity(id): CurrentIdentity) -> Json<DashboardData> {
    // id.user_id, id.is_staff are immediately usable
    ...
}
 
// Never rejects; `id` is None for anonymous callers:
async fn home(OptionalIdentity(id): OptionalIdentity) -> Json<Page> {
    let authenticated = id.is_some();
    ...
}