Struct AuthAwareService 

pub struct AuthAwareService { /* private fields */ }

Wrapper around [StorageService] that ensures each operation is authorized.

Authorization is performed according to the request’s authorization details, see also AuthContext. When crate::config::AuthZ::enforce is false, authorization failures are logged but any unauthorized operations are still allowed to proceed.

Objectstore API endpoints can use AuthAwareService simply by adding it to their handler function’s argument list like so:

use axum::http::StatusCode;
use objectstore_server::auth::AuthAwareService;

async fn my_endpoint(service: AuthAwareService) -> Result<StatusCode, StatusCode> {
    service.delete_object(todo!("pass some ID"))
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;

    Ok(StatusCode::NO_CONTENT)
}

Implementations

impl AuthAwareService

pub fn new(service: StorageService, context: AuthContext, enforce: bool) -> Self

Creates a new AuthAwareService using the given [StorageService], AuthContext, and enforcement setting.

The context is used to check whether each operation is authorized. enforce controls whether authorization failures will result in an error response or be ignored.

With an AuthContext::Disabled context, all operations are permitted.

pub fn check_permission( &self, perm: Permission, context: &ObjectContext, ) -> ApiResult<()>

Checks whether the request is authorized for the given permission on the given context.

Returns Ok(()) if authorized, or an error indicating the reason.

pub async fn insert_object( &self, context: ObjectContext, key: Option<String>, metadata: Metadata, stream: ClientStream, ) -> ApiResult<InsertResponse>

Auth-aware wrapper around [StorageService::insert_object].

pub async fn get_metadata(&self, id: ObjectId) -> ApiResult<MetadataResponse>

Auth-aware wrapper around [StorageService::get_metadata].

pub async fn get_object( &self, id: ObjectId, range: Option<ByteRange>, ) -> ApiResult<GetResponse>

Auth-aware wrapper around [StorageService::get_object].

pub async fn delete_object(&self, id: ObjectId) -> ApiResult<DeleteResponse>

Auth-aware wrapper around [StorageService::delete_object].

pub async fn initiate_multipart( &self, id: ObjectId, metadata: Metadata, ) -> ApiResult<InitiateMultipartResponse>

Auth-aware wrapper around [StorageService::initiate_multipart].

pub async fn upload_part( &self, id: ObjectId, upload_id: UploadId, part_number: PartNumber, content_length: u64, content_md5: Option<String>, body: ClientStream, ) -> ApiResult<UploadPartResponse>

Auth-aware wrapper around [StorageService::upload_part].

pub async fn list_parts( &self, id: ObjectId, upload_id: UploadId, max_parts: Option<u32>, part_number_marker: Option<PartNumber>, ) -> ApiResult<ListPartsResponse>

Auth-aware wrapper around [StorageService::list_parts].

pub async fn abort_multipart( &self, id: ObjectId, upload_id: UploadId, ) -> ApiResult<AbortMultipartResponse>

Auth-aware wrapper around [StorageService::abort_multipart].

pub async fn complete_multipart( &self, id: ObjectId, upload_id: UploadId, parts: Vec<CompletedPart>, ) -> ApiResult<CompleteMultipartResponse>

Auth-aware wrapper around [StorageService::complete_multipart].

Trait Implementations

impl Debug for AuthAwareService

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromRequestParts<Arc<Services>> for AuthAwareService

type Rejection = ApiError

If the extractor fails it’ll use this “rejection” type. A rejection is a kind of error that can be converted into a response.

async fn from_request_parts( parts: &mut Parts, state: &ServiceState, ) -> Result<Self, Self::Rejection>

Perform the extraction.