feat: Implement permissions checks for hackathon and testimonial routes, enhancing security with header validation

imphnen-cms/src/v1/landing/events/events_controller.rs

@@ -7,11 +7,12 @@ use super::{
 };
 use axum::extract::{Path, Query};
 use axum::response::IntoResponse;
-use axum::{Extension, Json};
+use axum::{Extension, Json, http::HeaderMap};
 use imphnen_libs::{
-	AppState, MessageResponseDto, MetaRequestDto, ResponseListSuccessDto,
-	ResponseSuccessDto,
+    AppState, MessageResponseDto, MetaRequestDto, ResponseListSuccessDto,
+    ResponseSuccessDto,
 };
+use imphnen_iam::{PermissionsEnum, permissions_guard};
 
 #[utoipa::path(
     get,
@@ -68,10 +69,14 @@ pub async fn get_event_by_id(
     tag = "Events"
 )]
 pub async fn post_create_event(
-	Extension(state): Extension<AppState>,
-	Json(payload): Json<EventsCreateRequestDto>,
+    headers: HeaderMap,
+    Extension(state): Extension<AppState>,
+    Json(payload): Json<EventsCreateRequestDto>,
 ) -> impl IntoResponse {
-	EventsService::create_event(&state, payload).await
+    match permissions_guard(headers, Extension(state), vec![PermissionsEnum::Administrator]).await {
+        Ok((_claims, state)) => EventsService::create_event(&state, payload).await,
+        Err(response) => response,
+    }
 }
 
 #[utoipa::path(
@@ -90,11 +95,15 @@ pub async fn post_create_event(
     tag = "Events"
 )]
 pub async fn patch_update_event(
-	Extension(state): Extension<AppState>,
-	Path(id): Path<String>,
-	Json(payload): Json<EventsUpdateRequestDto>,
+    headers: HeaderMap,
+    Extension(state): Extension<AppState>,
+    Path(id): Path<String>,
+    Json(payload): Json<EventsUpdateRequestDto>,
 ) -> impl IntoResponse {
-	EventsService::update_event(&state, id, payload).await
+    match permissions_guard(headers, Extension(state), vec![PermissionsEnum::Administrator]).await {
+        Ok((_claims, state)) => EventsService::update_event(&state, id, payload).await,
+        Err(response) => response,
+    }
 }
 
 #[utoipa::path(
@@ -112,8 +121,12 @@ pub async fn patch_update_event(
     tag = "Events"
 )]
 pub async fn delete_event(
-	Extension(state): Extension<AppState>,
-	Path(id): Path<String>,
+    headers: HeaderMap,
+    Extension(state): Extension<AppState>,
+    Path(id): Path<String>,
 ) -> impl IntoResponse {
-	EventsService::delete_event(&state, id).await
+    match permissions_guard(headers, Extension(state), vec![PermissionsEnum::Administrator]).await {
+        Ok((_claims, state)) => EventsService::delete_event(&state, id).await,
+        Err(response) => response,
+    }
 }

imphnen-cms/src/v1/landing/testimonials/testimonials_controller.rs

@@ -7,12 +7,13 @@ use super::{
 };
 use axum::extract::{Path, Query};
 use axum::response::IntoResponse;
-use axum::{Extension, Json};
+use axum::{Extension, Json, http::HeaderMap};
 use imphnen_iam::UsersDetailQueryDto;
 use imphnen_libs::{
-	AppState, MessageResponseDto, MetaRequestDto, ResponseListSuccessDto,
-	ResponseSuccessDto,
+    AppState, MessageResponseDto, MetaRequestDto, ResponseListSuccessDto,
+    ResponseSuccessDto,
 };
+use imphnen_iam::permissions_guard;
 
 #[utoipa::path(
     get,
@@ -69,11 +70,15 @@ pub async fn get_testimonial_by_id(
     tag = "Testimonials"
 )]
 pub async fn post_create_testimonial(
-	Extension(state): Extension<AppState>,
-	Extension(authenticated_user): Extension<UsersDetailQueryDto>,
-	Json(payload): Json<TestimonialsCreateRequestDto>,
+    headers: HeaderMap,
+    Extension(state): Extension<AppState>,
+    Extension(authenticated_user): Extension<UsersDetailQueryDto>,
+    Json(payload): Json<TestimonialsCreateRequestDto>,
 ) -> impl IntoResponse {
-	TestimonialsService::create_testimonial(&state, payload, &authenticated_user).await
+    match permissions_guard(headers, Extension(state), vec![]).await {
+        Ok((_claims, state)) => TestimonialsService::create_testimonial(&state, payload, &authenticated_user).await,
+        Err(response) => response,
+    }
 }
 
 #[utoipa::path(
@@ -92,13 +97,16 @@ pub async fn post_create_testimonial(
     tag = "Testimonials"
 )]
 pub async fn patch_update_testimonial(
-	Path(id): Path<String>,
-	Extension(state): Extension<AppState>,
-	Extension(authenticated_user): Extension<UsersDetailQueryDto>,
-	Json(payload): Json<TestimonialsUpdateRequestDto>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Extension(state): Extension<AppState>,
+    Extension(authenticated_user): Extension<UsersDetailQueryDto>,
+    Json(payload): Json<TestimonialsUpdateRequestDto>,
 ) -> impl IntoResponse {
-	TestimonialsService::update_testimonial(&state, id, payload, &authenticated_user)
-		.await
+    match permissions_guard(headers, Extension(state), vec![]).await {
+        Ok((_claims, state)) => TestimonialsService::update_testimonial(&state, id, payload, &authenticated_user).await,
+        Err(response) => response,
+    }
 }
 
 #[utoipa::path(
@@ -116,9 +124,13 @@ pub async fn patch_update_testimonial(
     tag = "Testimonials"
 )]
 pub async fn delete_testimonial(
-	Extension(state): Extension<AppState>,
-	Extension(authenticated_user): Extension<UsersDetailQueryDto>,
-	Path(id): Path<String>,
+    headers: HeaderMap,
+    Extension(state): Extension<AppState>,
+    Extension(authenticated_user): Extension<UsersDetailQueryDto>,
+    Path(id): Path<String>,
 ) -> impl IntoResponse {
-	TestimonialsService::delete_testimonial(&state, id, &authenticated_user).await
+    match permissions_guard(headers, Extension(state), vec![]).await {
+        Ok((_claims, state)) => TestimonialsService::delete_testimonial(&state, id, &authenticated_user).await,
+        Err(response) => response,
+    }
 }