Merge pull request #13 from QuantGeekDev/feature/users

Feature/users

Author: QuantGeekDev

Cargo.toml

@@ -4,9 +4,11 @@ version = "0.1.0"
 edition = "2021"
 
 [dependencies]
+bcrypt = "0.15.1"
 chrono = { version = "0.4.38", features = ["serde"] }
 diesel = { version = "2.2.4", features = ["postgres", "numeric", "serde_json", "chrono"] }
 dotenv = "0.15.0"
+jsonwebtoken = "9.3.0"
 rocket = { version = "0.5.1", features = ["json"] }
 rust_decimal = { version = "1.36.0", features = ["db-diesel-postgres", "serde-with-str"] }
 serde = "1.0.213"

migrations/2024-10-23-232744_create_users_table/down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS users CASCADE;

migrations/2024-10-23-232744_create_users_table/up.sql

@@ -0,0 +1,16 @@
+CREATE TABLE users
+(
+    id            SERIAL PRIMARY KEY,
+    username      VARCHAR   NOT NULL UNIQUE,
+    password_hash VARCHAR   NOT NULL,
+    role          VARCHAR   NOT NULL DEFAULT 'user',
+    created_at    TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at    TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+SELECT diesel_manage_updated_at('users');
+
+CREATE INDEX idx_users_username ON users (username);
+
+ALTER TABLE users
+    ADD CONSTRAINT valid_role CHECK (role IN ('user', 'admin'));

migrations/2024-10-23-235320_user_id_to_snacks/down.sql

@@ -0,0 +1 @@
+-- This file should undo anything in `up.sql`

migrations/2024-10-23-235320_user_id_to_snacks/up.sql

@@ -0,0 +1,27 @@
+ALTER TABLE snacks
+    ADD COLUMN user_id INTEGER;
+
+INSERT INTO users (username, password_hash, role, created_at, updated_at)
+SELECT 'admin',
+       '$2a$12$K6O5bFK6.O4V6csO94BFN.yvMkv4pOXxYH.rolz4.Y4.pxpwB6fvC',
+       'admin',
+       CURRENT_TIMESTAMP,
+       CURRENT_TIMESTAMP
+    WHERE NOT EXISTS (
+    SELECT 1 FROM users WHERE username = 'admin'
+) RETURNING id;
+
+UPDATE snacks
+SET user_id = (SELECT id FROM users WHERE username = 'admin')
+WHERE user_id IS NULL;
+
+ALTER TABLE snacks
+    ALTER COLUMN user_id SET NOT NULL;
+
+ALTER TABLE snacks
+    ADD CONSTRAINT fk_snacks_user
+        FOREIGN KEY (user_id)
+            REFERENCES users(id)
+            ON DELETE CASCADE;
+
+CREATE INDEX idx_snacks_user_id ON snacks(user_id);

src/auth/mod.rs

@@ -1,29 +1 @@
-pub struct ApiKey(pub String);
-use rocket::{http::Status, request::{FromRequest, Outcome}, Request};
-use std::env;
-
-#[derive(Debug)]
-pub enum ApiKeyError {
-    Missing,
-    Invalid,
-}
-
-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for ApiKey {
-    type Error = ApiKeyError;
-
-    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-        let api_key = request.headers().get_one("x-api-key");
-
-        match api_key {
-            None => Outcome::Error((Status::Unauthorized, ApiKeyError::Missing)),
-            Some(api_key) => {
-                if api_key == env::var("AUTH_API_KEY").unwrap() {
-                    Outcome::Success(ApiKey(api_key.to_string()))
-                } else {
-                    Outcome::Error((Status::Unauthorized, ApiKeyError::Invalid))
-                }
-            }
-        }
-    }
-}
+pub mod user;

src/auth/user.rs

@@ -0,0 +1,46 @@
+use crate::models::user::User;
+use diesel::prelude::*;
+use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};
+use rocket::http::Status;
+use rocket::request::{FromRequest, Outcome};
+use rocket::Request;
+use serde::{Deserialize, Serialize};
+
+pub struct AuthenticatedUser(pub User);
+
+#[derive(Debug, Serialize, Deserialize)]
+pub(crate) struct Claims {
+    pub(crate) sub: i32,
+    pub(crate) role: String,
+    pub(crate) exp: usize,
+}
+
+#[rocket::async_trait]
+impl<'r> FromRequest<'r> for AuthenticatedUser {
+    type Error = ();
+
+    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
+        let token = request.headers().get_one("Authorization");
+
+        match token {
+            Some(token) if token.starts_with("Bearer ") => {
+                let token = &token[7..];
+                let decoding_key = DecodingKey::from_secret("SECRET".as_ref());
+                match decode::<Claims>(token, &decoding_key, &Validation::new(Algorithm::HS256)) {
+                    Ok(token_data) => {
+                        let mut conn = crate::db::establish_connection();
+                        match crate::schema::users::dsl::users
+                            .find(token_data.claims.sub)
+                            .first::<User>(&mut conn)
+                        {
+                            Ok(user) => Outcome::Success(AuthenticatedUser(user)),
+                            Err(_) => Outcome::Error((Status::Unauthorized, ())),
+                        }
+                    }
+                    Err(_) => Outcome::Error((Status::Unauthorized, ())),
+                }
+            }
+            _ => Outcome::Error((Status::Unauthorized, ())),
+        }
+    }
+}

src/catchers/mod.rs

@@ -18,15 +18,15 @@ pub fn unauthorized(req: &Request) -> Json<ErrorResponse> {
 }
 
 #[catch(404)]
-pub fn not_found(req: &Request) -> Json<ErrorResponse> {
+pub fn not_found(_req: &Request) -> Json<ErrorResponse> {
     Json(ErrorResponse {
         status: 404,
         message: "Page not found".to_string(),
     })
 }
 
 #[catch(500)]
-pub fn internal_server_error(req: &Request) -> Json<ErrorResponse> {
+pub fn internal_server_error(_req: &Request) -> Json<ErrorResponse> {
     Json(ErrorResponse {
         status: 500,
         message: "Internal Server Error".to_string(),

src/main.rs

@@ -8,6 +8,7 @@ mod catchers;
 mod db;
 mod schema;
 
+use crate::routes::auth::{login, register};
 use crate::routes::snack::{create_snack, delete_snack, list_snacks, update_snack};
 use dotenv::dotenv;
 use rocket::*;
@@ -28,7 +29,7 @@ fn index() -> &'static str {
 fn rocket() -> _ {
     dotenv().ok();
 
-    rocket::build().mount("/", routes![index, create_snack, list_snacks, update_snack, delete_snack]).register("/", catchers![catchers::unauthorized, catchers::not_found,
+    rocket::build().mount("/", routes![index, create_snack, list_snacks, update_snack, delete_snack, register, login]).register("/", catchers![catchers::unauthorized, catchers::not_found,
      catchers::internal_server_error])
 }
 

src/models/mod.rs

@@ -1 +1,2 @@
-pub mod snack;
+pub mod snack;
+pub(crate) mod user;