MythEclipse/imphnen-backend-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: v0.3.0 — standardize codebase, centralize infra, merge QR into CMS

Browse Source 
- Enforce axum best practices across all 13 workspace crates
  (max 200 LOC/file, no comments, no unwrap, clean architecture)
- Fix domain→infrastructure dependency inversions in imphnen-iam and imphnen-dimentorin
- Extract imphnen-storage (MinIO) and imphnen-email (Lettre) as standalone crates
- Centralize all config in ENV struct: CDN_URL, CORS_ALLOWED_ORIGINS
- Centralize SMTP through imphnen-email; remove dead HackathonConfig
- Centralize database: QR crate now shares main DB pool (single DATABASE_URL)
- Rename QR users table to qr_users to avoid collision with main users table
- Merge imphnen-qr into imphnen-cms/src/qr (13 crates, down from 14)
- Restructure imphnen-hackathon flat modules into clean architecture
- Remove all stale env vars from .env.example (SurrealDB, QR_JWT, Hackathon infra)
- Fix Dockerfile to include all current workspace crates
- Bump all crate versions 0.2.0 → 0.3.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
maulanasdqn
2026-04-02 22:29:08 +07:00
co-authored by Claude Sonnet 4.6
parent 2ae43b3bcc
commit 331a4a4e88
442 changed files with 22226 additions and 18700 deletions
Download Patch File Download Diff File Expand all files Collapse all files
imphnen-iam/src/permissions_guard.rs
+75 -54
View File
@@ -1,69 +1,90 @@
use imphnen_entities::PermissionsEnum;
use crate::{AppState, decode_access_token};
use axum::{
http::HeaderMap,
Extension,
};
use axum_extra::headers::{authorization::Bearer, Authorization, HeaderMapExt};
use axum::{Extension, http::HeaderMap};
use axum_extra::headers::{Authorization, HeaderMapExt, authorization::Bearer};
use imphnen_entities::PermissionsEnum;
use imphnen_utils::AppError;
use uuid::Uuid;
pub async fn permissions_guard(
headers: HeaderMap,
Extension(state): Extension<AppState>,
required_permissions: Vec<PermissionsEnum>,
headers: HeaderMap,
Extension(state): Extension<AppState>,
required_permissions: Vec<PermissionsEnum>,
) -> Result<(imphnen_libs::jsonwebtoken::Claims, AppState), AppError> {
let auth_header = headers
.typed_get::<Authorization<Bearer>>()
.ok_or_else(|| AppError::AuthenticationError("Invalid or missing authorization token".to_string()))?;
let auth_header =
headers
.typed_get::<Authorization<Bearer>>()
.ok_or_else(|| {
AppError::AuthenticationError(
"Invalid or missing authorization token".to_string(),
)
})?;
let token = auth_header.token();
let token = auth_header.token();
let claims = decode_access_token(token)
.map_err(|_| AppError::AuthenticationError("Invalid or expired token".to_string()))?
.claims;
let claims = decode_access_token(token)
.map_err(|_| {
AppError::AuthenticationError("Invalid or expired token".to_string())
})?
.claims;
let user_info = {
let by_email = state.user_lookup_service.get_user_by_email(&claims.sub, &state).await;
match by_email {
Ok(info) => info,
Err(_) => {
let user_id = Uuid::parse_str(&claims.sub)
.map_err(|_| AppError::AuthenticationError("Invalid user ID format".to_string()))?;
state.user_lookup_service.get_user_by_id(user_id, &state).await
.map_err(|_| AppError::AuthenticationError("User not found".to_string()))?
}
}
};
let user_info = {
let by_email = state
.user_lookup_service
.get_user_by_email(&claims.sub, &state)
.await;
match by_email {
Ok(info) => info,
Err(_) => {
let user_id = Uuid::parse_str(&claims.sub).map_err(|_| {
AppError::AuthenticationError("Invalid user ID format".to_string())
})?;
state
.user_lookup_service
.get_user_by_id(user_id, &state)
.await
.map_err(|_| AppError::AuthenticationError("User not found".to_string()))?
}
}
};
let user_permissions: Vec<String> = user_info.basic_info.role
.permissions
.as_ref()
.unwrap_or(&vec![])
.iter()
.filter_map(|p| p.as_ref())
.flat_map(|pp| {
let mut res: Vec<String> = Vec::new();
if let Some(name) = pp.name.clone() { res.push(name); }
if let Some(id) = pp.id.as_ref().map(|id| id.to_string()) { res.push(id); }
res
})
.collect();
let user_permissions: Vec<String> = user_info
.basic_info
.role
.permissions
.as_ref()
.unwrap_or(&vec![])
.iter()
.filter_map(|p| p.as_ref())
.flat_map(|pp| {
let mut res: Vec<String> = Vec::new();
if let Some(name) = pp.name.clone() {
res.push(name);
}
if let Some(id) = pp.id.as_ref().map(|id| id.to_string()) {
res.push(id);
}
res
})
.collect();
let admin_name = PermissionsEnum::Administrator.to_string();
let admin_id = PermissionsEnum::Administrator.id();
let admin_name = PermissionsEnum::Administrator.to_string();
let admin_id = PermissionsEnum::Administrator.id();
if user_permissions.contains(&admin_name) || user_permissions.contains(&admin_id) {
return Ok((claims, state));
}
if user_permissions.contains(&admin_name) || user_permissions.contains(&admin_id) {
return Ok((claims, state));
}
for required in &required_permissions {
let required_str = required.to_string();
let required_id = required.id();
if !user_permissions.contains(&required_str) && !user_permissions.contains(&required_id) {
return Err(AppError::ForbiddenError("You don't have the required permissions".to_string()));
}
}
for required in &required_permissions {
let required_str = required.to_string();
let required_id = required.id();
if !user_permissions.contains(&required_str)
&& !user_permissions.contains(&required_id)
{
return Err(AppError::ForbiddenError(
"You don't have the required permissions".to_string(),
));
}
}
Ok((claims, state))
Ok((claims, state))
}