MythEclipse/imphnen-backend-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Simplify token generation by removing unnecessary permissions parameter from access and refresh token functions

Browse Source
This commit is contained in:
MythEclipse
2025-09-22 07:52:00 +07:00
parent 042e0b4eff
commit e7c17784cc
4 changed files with 33 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
imphnen-iam/src/v1/auth/auth_service.rs
+7 -13
View File
@@ -98,11 +98,9 @@ impl AuthServiceTrait for AuthService {
);
}
// Avoid unnecessary clone of user for caching if not needed
let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.as_str()).map(str::to_owned).collect();
let user_id = user.id.id.to_raw();
let access_token = match encode_access_token(email.to_string(), user_id.clone(), permissions.clone()) {
let access_token = match encode_access_token(email.to_string(), user_id.clone()) {
Ok(token) => token,
Err(_e) => {
error!(
@@ -116,7 +114,7 @@ impl AuthServiceTrait for AuthService {
}
};
let refresh_token = match encode_refresh_token(email.to_string(), user_id, permissions) {
let refresh_token = match encode_refresh_token(email.to_string(), user_id) {
Ok(token) => token,
Err(_e) => {
error!(
@@ -205,8 +203,7 @@ impl AuthServiceTrait for AuthService {
);
}
let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
let access_token = match encode_access_token(payload.email.clone(), user.id.id.to_raw(), permissions.clone()) {
let access_token = match encode_access_token(payload.email.clone(), user.id.id.to_raw()) {
Ok(token) => token,
Err(_e) => {
error!(
@@ -220,8 +217,7 @@ impl AuthServiceTrait for AuthService {
}
};
let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
let refresh_token = match encode_refresh_token(payload.email.clone(), user.id.id.to_raw(), permissions) {
let refresh_token = match encode_refresh_token(payload.email.clone(), user.id.id.to_raw()) {
Ok(token) => token,
Err(_e) => {
error!(
@@ -432,8 +428,7 @@ impl AuthServiceTrait for AuthService {
}
};
let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
let access_token = match encode_access_token(user.email.clone(), user.id.id.to_raw(), permissions.clone()) {
let access_token = match encode_access_token(user.email.clone(), user.id.id.to_raw()) {
Ok(token) => token,
Err(_e) => {
error!("Failed to generate access token for {}: {}", user.email, _e);
@@ -443,7 +438,7 @@ impl AuthServiceTrait for AuthService {
);
}
};
let refresh_token = match encode_refresh_token(user.email.clone(), user.id.id.to_raw(), permissions) {
let refresh_token = match encode_refresh_token(user.email.clone(), user.id.id.to_raw()) {
Ok(token) => token,
Err(_e) => {
error!("Failed to generate refresh token for {}: {}", user.email, _e);
@@ -477,8 +472,7 @@ impl AuthServiceTrait for AuthService {
tokio::spawn(async move {
let user_repo = UsersRepository::new(&state);
if let Ok(user) = user_repo.query_user_by_email(payload.email.clone()).await {
let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
let token = match encode_reset_password_token(user.email.clone(), user.id.id.to_raw(), permissions) {
let token = match encode_reset_password_token(user.email.clone(), user.id.id.to_raw()) {
Ok(token) => token,
Err(_e) => {
error!("Failed to generate reset password token for {}: {}", user.email, _e);
imphnen-iam/src/v1/auth/google/google_oauth_service.rs
+2 -4
View File
@@ -338,15 +338,13 @@ where
}
};
let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
let access_token = encode_access_token(user.email.clone(), user.id.clone(), permissions.clone())
let access_token = encode_access_token(user.email.clone(), user.id.clone())
.map_err(|e| {
error!("Failed to generate access token for {}: {:?}", user.email, e);
Error::Auth("Failed to generate access token".to_string())
})?;
let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
let refresh_token = encode_refresh_token(user.email.clone(), user.id.clone(), permissions)
let refresh_token = encode_refresh_token(user.email.clone(), user.id.clone())
.map_err(|e| {
error!("Failed to generate refresh token for {}: {:?}", user.email, e);
Error::Auth("Failed to generate refresh token".to_string())
imphnen-iam/src/v1/permissions/permissions_guard.rs
+16 -4
View File
@@ -1,11 +1,10 @@
use super::PermissionsEnum;
use crate::{AppState, common_response, decode_access_token};
use crate::{AppState, common_response, decode_access_token, UsersRepository};
use axum::{
http::{HeaderMap, StatusCode},
response::Response, Extension,
};
use axum_extra::headers::{authorization::Bearer, Authorization, HeaderMapExt};
// Removed imphnen_utils::make_thing as it's no longer needed here
pub async fn permissions_guard(
headers: HeaderMap,
@@ -32,10 +31,23 @@ pub async fn permissions_guard(
})?
.claims;
// Use permissions from JWT for the check
// Fetch user from database to get permissions
let user_repo = UsersRepository::new(&state);
let user = match user_repo.query_user_by_email(claims.sub.clone()).await {
Ok(user) => user,
Err(_) => {
return Err(common_response(
StatusCode::UNAUTHORIZED,
"User not found",
));
}
};
// Check permissions from database
let user_permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
for required in &required_permissions {
let required_str = required.to_string();
if !claims.permissions.contains(&required_str) {
if !user_permissions.contains(&required_str) {
eprintln!(" MISSING REQUIRED PERMISSION: {required_str}");
return Err(common_response(
StatusCode::FORBIDDEN,