update sso example

This commit is contained in:
Greg Johnston 2024-01-19 18:02:22 -05:00
parent eb45d05f3b
commit 70ec0c2d0a
8 changed files with 280 additions and 261 deletions

View file

@ -7,40 +7,39 @@ edition = "2021"
crate-type = ["cdylib", "rlib"]
[dependencies]
oauth2 = {version="4.4.2",optional=true}
oauth2 = { version = "4.4.2", optional = true }
anyhow = "1.0.66"
console_log = "1.0.0"
rand = { version = "0.8.5", features = ["min_const_gen"], optional = true }
console_error_panic_hook = "0.1.7"
futures = "0.3.25"
cfg-if = "1.0.0"
leptos = { path = "../../leptos"}
leptos = { path = "../../leptos" }
leptos_meta = { path = "../../meta" }
leptos_axum = { path = "../../integrations/axum", optional = true }
leptos_router = { path = "../../router"}
leptos_router = { path = "../../router" }
log = "0.4.17"
simple_logger = "4.0.0"
serde = { version = "1.0.148", features = ["derive"] }
serde_json = {version="1.0.108", optional = true }
axum = { version = "0.6.1", optional = true, features=["macros"] }
tower = { version = "0.4.13", optional = true }
tower-http = { version = "0.4", features = ["fs"], optional = true }
serde_json = { version = "1.0.108", optional = true }
axum = { version = "0.7", optional = true, features = ["macros"] }
tower = { version = "0.4", optional = true }
tower-http = { version = "0.5", features = ["fs"], optional = true }
tokio = { version = "1.22.0", features = ["full"], optional = true }
http = { version = "0.2.8" }
http = { version = "1" }
sqlx = { version = "0.7", features = [
"runtime-tokio-rustls",
"sqlite",
], optional = true }
thiserror = "1.0.38"
wasm-bindgen = "0.2"
axum_session_auth = { version = "0.9", features = [
axum_session_auth = { version = "0.12", features = [
"sqlite-rustls",
], optional = true }
axum_session = { version = "0.9", features = [
axum_session = { version = "0.12", features = [
"sqlite-rustls",
], optional = true }
async-trait = { version = "0.1.64", optional = true }
reqwest= {version="0.11",optional=true, features=["json"]}
reqwest = { version = "0.11", optional = true, features = ["json"] }
[features]
hydrate = ["leptos/hydrate", "leptos_meta/hydrate", "leptos_router/hydrate"]
@ -64,7 +63,6 @@ ssr = [
]
[package.metadata.leptos]
# The name used by wasm-bindgen/cargo-leptos for the JS/WASM bundle. Defaults to the crate name
output-name = "sso_auth_axum"

View file

@ -1,14 +1,6 @@
use cfg_if::cfg_if;
use serde::{Deserialize, Serialize};
use std::collections::HashSet;
cfg_if! {
if #[cfg(feature = "ssr")] {
use sqlx::SqlitePool;
use axum_session_auth::{SessionSqlitePool, Authentication, HasPermission};
pub type AuthSession = axum_session_auth::AuthSession<User, i64, SessionSqlitePool, SqlitePool>;
}}
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct User {
pub id: i64,
@ -28,36 +20,56 @@ impl Default for User {
}
}
cfg_if! {
if #[cfg(feature = "ssr")] {
#[cfg(feature = "ssr")]
pub mod ssr_imports {
use super::User;
pub use axum_session_auth::{
Authentication, HasPermission, SessionSqlitePool,
};
pub use sqlx::SqlitePool;
use std::collections::HashSet;
pub type AuthSession = axum_session_auth::AuthSession<
User,
i64,
SessionSqlitePool,
SqlitePool,
>;
use async_trait::async_trait;
impl User {
pub async fn get(id: i64, pool: &SqlitePool) -> Option<Self> {
let sqluser = sqlx::query_as::<_, SqlUser>("SELECT * FROM users WHERE id = ?")
.bind(id)
.fetch_one(pool)
.await
.ok()?;
let sqluser = sqlx::query_as::<_, SqlUser>(
"SELECT * FROM users WHERE id = ?",
)
.bind(id)
.fetch_one(pool)
.await
.ok()?;
//lets just get all the tokens the user can use, we will only use the full permissions if modifing them.
let sql_user_perms = sqlx::query_as::<_, SqlPermissionTokens>(
"SELECT token FROM user_permissions WHERE user_id = ?;",
)
.bind(id)
.fetch_all(pool)
.await
.ok()?;
.bind(id)
.fetch_all(pool)
.await
.ok()?;
Some(sqluser.into_user(Some(sql_user_perms)))
}
pub async fn get_from_email(email: &str, pool: &SqlitePool) -> Option<Self> {
let sqluser = sqlx::query_as::<_, SqlUser>("SELECT * FROM users WHERE email = ?")
.bind(email)
.fetch_one(pool)
.await
.ok()?;
pub async fn get_from_email(
email: &str,
pool: &SqlitePool,
) -> Option<Self> {
let sqluser = sqlx::query_as::<_, SqlUser>(
"SELECT * FROM users WHERE email = ?",
)
.bind(email)
.fetch_one(pool)
.await
.ok()?;
//lets just get all the tokens the user can use, we will only use the full permissions if modifing them.
let sql_user_perms = sqlx::query_as::<_, SqlPermissionTokens>(
@ -84,7 +96,10 @@ if #[cfg(feature = "ssr")] {
#[async_trait]
impl Authentication<User, i64, SqlitePool> for User {
async fn load_user(userid: i64, pool: Option<&SqlitePool>) -> Result<User, anyhow::Error> {
async fn load_user(
userid: i64,
pool: Option<&SqlitePool>,
) -> Result<User, anyhow::Error> {
let pool = pool.unwrap();
User::get(userid, pool)
@ -123,9 +138,11 @@ if #[cfg(feature = "ssr")] {
pub secret: String,
}
impl SqlUser {
pub fn into_user(self, sql_user_perms: Option<Vec<SqlPermissionTokens>>) -> User {
pub fn into_user(
self,
sql_user_perms: Option<Vec<SqlPermissionTokens>>,
) -> User {
User {
id: self.id,
email: self.email,
@ -141,4 +158,3 @@ if #[cfg(feature = "ssr")] {
}
}
}
}

View file

@ -14,7 +14,6 @@ pub fn error_template(errors: RwSignal<Errors>) -> View {
children= move | (_, error)| {
let error_string = error.to_string();
view! {
<p>"Error: " {error_string}</p>
}
}

View file

@ -1,47 +1,49 @@
use cfg_if::cfg_if;
use crate::error_template::error_template;
use axum::{
body::Body,
extract::State,
http::{Request, Response, StatusCode, Uri},
response::{IntoResponse, Response as AxumResponse},
};
use leptos::*;
use tower::ServiceExt;
use tower_http::services::ServeDir;
cfg_if! {
if #[cfg(feature = "ssr")] {
use axum::{
body::{boxed, Body, BoxBody},
extract::State,
response::IntoResponse,
http::{Request, Response, StatusCode, Uri},
};
use axum::response::Response as AxumResponse;
use tower::ServiceExt;
use tower_http::services::ServeDir;
use leptos::*;
use crate::error_template::error_template;
pub async fn file_and_error_handler(
uri: Uri,
State(options): State<LeptosOptions>,
req: Request<Body>,
) -> AxumResponse {
let root = options.site_root.clone();
let res = get_static_file(uri.clone(), &root).await.unwrap();
pub async fn file_and_error_handler(uri: Uri, State(options): State<LeptosOptions>, req: Request<Body>) -> AxumResponse {
let root = options.site_root.clone();
let res = get_static_file(uri.clone(), &root).await.unwrap();
if res.status() == StatusCode::OK {
res.into_response()
} else {
leptos::logging::log!("{:?}:{}",res.status(),uri);
let handler = leptos_axum::render_app_to_stream(
options.to_owned(),
|| error_template(create_rw_signal(leptos::Errors::default())
)
);
handler(req).await.into_response()
}
}
async fn get_static_file(uri: Uri, root: &str) -> Result<Response<BoxBody>, (StatusCode, String)> {
let req = Request::builder().uri(uri.clone()).body(Body::empty()).unwrap();
// `ServeDir` implements `tower::Service` so we can call it with `tower::ServiceExt::oneshot`
// This path is relative to the cargo root
match ServeDir::new(root).oneshot(req).await {
Ok(res) => Ok(res.map(boxed)),
Err(err) => Err((
StatusCode::INTERNAL_SERVER_ERROR,
format!("Something went wrong: {}", err),
)),
}
}
if res.status() == StatusCode::OK {
res.into_response()
} else {
leptos::logging::log!("{:?}:{}", res.status(), uri);
let handler =
leptos_axum::render_app_to_stream(options.to_owned(), || {
error_template(create_rw_signal(leptos::Errors::default()))
});
handler(req).await.into_response()
}
}
async fn get_static_file(
uri: Uri,
root: &str,
) -> Result<Response<Body>, (StatusCode, String)> {
let req = Request::builder()
.uri(uri.clone())
.body(Body::empty())
.unwrap();
// `ServeDir` implements `tower::Service` so we can call it with `tower::ServiceExt::oneshot`
// This path is relative to the cargo root
match ServeDir::new(root).oneshot(req).await {
Ok(res) => Ok(res.into_response()),
Err(err) => Err((
StatusCode::INTERNAL_SERVER_ERROR,
format!("Something went wrong: {}", err),
)),
}
}

View file

@ -1,36 +1,30 @@
use cfg_if::cfg_if;
pub mod auth;
pub mod error_template;
#[cfg(feature = "ssr")]
pub mod fallback;
pub mod sign_in_sign_up;
#[cfg(feature = "ssr")]
pub mod state;
use leptos::{leptos_dom::helpers::TimeoutHandle, *};
use leptos_meta::*;
use leptos_router::*;
use sign_in_sign_up::*;
cfg_if! {
if #[cfg(feature = "ssr")] {
use crate::{
state::AppState,
auth::{AuthSession,User,SqlRefreshToken}
};
use oauth2::{
reqwest::async_http_client,
TokenResponse
};
use sqlx::SqlitePool;
#[cfg(feature = "ssr")]
mod ssr_imports {
pub use crate::auth::ssr_imports::{AuthSession, SqlRefreshToken};
pub use leptos::{use_context, ServerFnError};
pub use oauth2::{reqwest::async_http_client, TokenResponse};
pub use sqlx::SqlitePool;
pub fn pool() -> Result<SqlitePool, ServerFnError> {
use_context::<SqlitePool>()
.ok_or_else(|| ServerFnError::ServerError("Pool missing.".into()))
}
pub fn pool() -> Result<SqlitePool, ServerFnError> {
use_context::<SqlitePool>()
.ok_or_else(|| ServerFnError::new("Pool missing."))
}
pub fn auth() -> Result<AuthSession, ServerFnError> {
use_context::<AuthSession>()
.ok_or_else(|| ServerFnError::ServerError("Auth session missing.".into()))
}
pub fn auth() -> Result<AuthSession, ServerFnError> {
use_context::<AuthSession>()
.ok_or_else(|| ServerFnError::new("Auth session missing."))
}
}
@ -40,11 +34,14 @@ pub struct Email(RwSignal<Option<String>>);
pub struct ExpiresIn(RwSignal<u64>);
#[server]
pub async fn refresh_token(email: String) -> Result<u64, ServerFnError> {
use crate::{auth::User, state::AppState};
use ssr_imports::*;
let pool = pool()?;
let oauth_client = expect_context::<AppState>().client;
let user = User::get_from_email(&email, &pool)
.await
.ok_or(ServerFnError::ServerError("User not found".to_string()))?;
.ok_or(ServerFnError::new("User not found"))?;
let refresh_secret = sqlx::query_as::<_, SqlRefreshToken>(
"SELECT secret FROM google_refresh_tokens WHERE user_id = ?",
@ -77,6 +74,7 @@ pub async fn refresh_token(email: String) -> Result<u64, ServerFnError> {
.await?;
Ok(expires_in)
}
#[component]
pub fn App() -> impl IntoView {
provide_meta_context();
@ -143,20 +141,11 @@ pub fn App() -> impl IntoView {
}
}
// Needs to be in lib.rs AFAIK because wasm-bindgen needs us to be compiling a lib. I may be wrong.
cfg_if! {
if #[cfg(feature = "hydrate")] {
use wasm_bindgen::prelude::wasm_bindgen;
use leptos::view;
#[cfg(feature = "hydrate")]
#[wasm_bindgen::prelude::wasm_bindgen]
pub fn hydrate() {
_ = console_log::init_with_level(log::Level::Debug);
console_error_panic_hook::set_once();
#[wasm_bindgen]
pub fn hydrate() {
_ = console_log::init_with_level(log::Level::Debug);
console_error_panic_hook::set_once();
leptos::mount_to_body(|| {
view! { <App/> }
});
}
}
leptos::mount_to_body(App);
}

View file

@ -1,136 +1,154 @@
use cfg_if::cfg_if;
use crate::ssr_imports::*;
use axum::{
body::Body as AxumBody,
extract::{Path, State},
http::Request,
response::IntoResponse,
routing::get,
Router,
};
use axum_session::{Key, SessionConfig, SessionLayer, SessionStore};
use axum_session_auth::{AuthConfig, AuthSessionLayer, SessionSqlitePool};
use leptos::{get_configuration, logging::log, provide_context, view};
use leptos_axum::{
generate_route_list, handle_server_fns_with_context, LeptosRoutes,
};
use sqlx::{sqlite::SqlitePoolOptions, SqlitePool};
use sso_auth_axum::{
auth::*, fallback::file_and_error_handler, state::AppState,
};
// boilerplate to run in different modes
cfg_if! {
if #[cfg(feature = "ssr")] {
use axum::{
response::{IntoResponse},
routing::get,
extract::{Path, State, RawQuery},
http::{Request, header::HeaderMap},
body::Body as AxumBody,
Router,
};
use sso_auth_axum::auth::*;
use sso_auth_axum::state::AppState;
use sso_auth_axum::fallback::file_and_error_handler;
use leptos_axum::{generate_route_list, handle_server_fns_with_context, LeptosRoutes};
use leptos::{logging::log, view, provide_context, get_configuration};
use sqlx::{SqlitePool, sqlite::SqlitePoolOptions};
use axum_session::{SessionConfig, SessionLayer, SessionStore,Key, SecurityMode};
use axum_session_auth::{AuthSessionLayer, AuthConfig, SessionSqlitePool};
async fn server_fn_handler(
State(app_state): State<AppState>,
auth_session: AuthSession,
path: Path<String>,
request: Request<AxumBody>,
) -> impl IntoResponse {
log!("{:?}", path);
async fn server_fn_handler(State(app_state): State<AppState>, auth_session: AuthSession, path: Path<String>, headers: HeaderMap, raw_query: RawQuery,
request: Request<AxumBody>) -> impl IntoResponse {
log!("{:?}", path);
handle_server_fns_with_context(path, headers, raw_query, move || {
handle_server_fns_with_context(
move || {
provide_context(app_state.clone());
provide_context(auth_session.clone());
provide_context(app_state.pool.clone());
}, request).await
}
},
request,
)
.await
}
pub async fn leptos_routes_handler(
auth_session: AuthSession,
State(app_state): State<AppState>,
axum::extract::State(option): axum::extract::State<leptos::LeptosOptions>,
request: Request<AxumBody>,
) -> axum::response::Response {
let handler = leptos_axum::render_app_async_with_context(
option.clone(),
move || {
provide_context(app_state.clone());
provide_context(auth_session.clone());
provide_context(app_state.pool.clone());
},
move || view! { <sso_auth_axum::App/> },
);
pub async fn leptos_routes_handler(
auth_session: AuthSession,
State(app_state): State<AppState>,
axum::extract::State(option): axum::extract::State<leptos::LeptosOptions>,
request: Request<AxumBody>,
) -> axum::response::Response {
let handler = leptos_axum::render_app_async_with_context(
option.clone(),
move || {
provide_context(app_state.clone());
provide_context(auth_session.clone());
provide_context(app_state.pool.clone());
},
move || view! { <sso_auth_axum::App/> },
);
handler(request).await.into_response()
}
handler(request).await.into_response()
}
#[tokio::main]
async fn main() {
simple_logger::init_with_level(log::Level::Info)
.expect("couldn't initialize logging");
#[tokio::main]
async fn main() {
simple_logger::init_with_level(log::Level::Info).expect("couldn't initialize logging");
let pool = SqlitePoolOptions::new()
.connect("sqlite:sso.db")
.await
.expect("Could not make pool.");
let pool = SqlitePoolOptions::new()
.connect("sqlite:sso.db")
.await
.expect("Could not make pool.");
// Auth section
let session_config = SessionConfig::default()
.with_table_name("sessions_table")
.with_key(Key::generate())
.with_database_key(Key::generate());
// .with_security_mode(SecurityMode::PerSession); // FIXME did this disappear?
// Auth section
let session_config = SessionConfig::default()
.with_table_name("sessions_table")
.with_key(Key::generate())
.with_database_key(Key::generate())
.with_security_mode(SecurityMode::PerSession);
let auth_config = AuthConfig::<i64>::default();
let session_store = SessionStore::<SessionSqlitePool>::new(
Some(pool.clone().into()),
session_config,
)
.await
.unwrap();
let auth_config = AuthConfig::<i64>::default();
let session_store = SessionStore::<SessionSqlitePool>::new(Some(pool.clone().into()), session_config).await.unwrap();
sqlx::migrate!()
.run(&pool)
.await
.expect("could not run SQLx migrations");
sqlx::migrate!()
.run(&pool)
.await
.expect("could not run SQLx migrations");
// Setting this to None means we'll be using cargo-leptos and its env vars
let conf = get_configuration(None).await.unwrap();
let leptos_options = conf.leptos_options;
let addr = leptos_options.site_addr;
let routes = generate_route_list(sso_auth_axum::App);
// Setting this to None means we'll be using cargo-leptos and its env vars
let conf = get_configuration(None).await.unwrap();
let leptos_options = conf.leptos_options;
let addr = leptos_options.site_addr;
let routes = generate_route_list(sso_auth_axum::App);
// We create our client using provided environment variables.
// We create our client using provided environment variables.
let client = oauth2::basic::BasicClient::new(
oauth2::ClientId::new(std::env::var("G_AUTH_CLIENT_ID").expect("G_AUTH_CLIENT Env var to be set.")),
Some(oauth2::ClientSecret::new(std::env::var("G_AUTH_SECRET").expect("G_AUTH_SECRET Env var to be set"))),
oauth2::ClientId::new(
std::env::var("G_AUTH_CLIENT_ID")
.expect("G_AUTH_CLIENT Env var to be set."),
),
Some(oauth2::ClientSecret::new(
std::env::var("G_AUTH_SECRET")
.expect("G_AUTH_SECRET Env var to be set"),
)),
oauth2::AuthUrl::new(
"https://accounts.google.com/o/oauth2/v2/auth".to_string(),
)
.unwrap(),
Some(
oauth2::TokenUrl::new("https://oauth2.googleapis.com/token".to_string())
.unwrap(),
oauth2::TokenUrl::new(
"https://oauth2.googleapis.com/token".to_string(),
)
.unwrap(),
),
)
.set_redirect_uri(oauth2::RedirectUrl::new(std::env::var("REDIRECT_URL").expect("REDIRECT_URL Env var to be set")).unwrap());
.set_redirect_uri(
oauth2::RedirectUrl::new(
std::env::var("REDIRECT_URL")
.expect("REDIRECT_URL Env var to be set"),
)
.unwrap(),
);
let app_state = AppState {
leptos_options,
pool: pool.clone(),
client,
};
let app_state = AppState{
leptos_options,
pool: pool.clone(),
client,
};
// build our application with a route
let app = Router::new()
.route(
"/api/*fn_name",
get(server_fn_handler).post(server_fn_handler),
)
.leptos_routes_with_handler(routes, get(leptos_routes_handler))
.fallback(file_and_error_handler)
.layer(
AuthSessionLayer::<User, i64, SessionSqlitePool, SqlitePool>::new(
Some(pool.clone()),
)
.with_config(auth_config),
)
.layer(SessionLayer::new(session_store))
.with_state(app_state);
// build our application with a route
let app = Router::new()
.route("/api/*fn_name", get(server_fn_handler).post(server_fn_handler))
.leptos_routes_with_handler(routes, get(leptos_routes_handler) )
.fallback(file_and_error_handler)
.layer(AuthSessionLayer::<User, i64, SessionSqlitePool, SqlitePool>::new(Some(pool.clone()))
.with_config(auth_config))
.layer(SessionLayer::new(session_store))
.with_state(app_state);
// run our app with hyper
// `axum::Server` is a re-export of `hyper::Server`
log!("listening on http://{}", &addr);
axum::Server::bind(&addr)
.serve(app.into_make_service())
.await
.unwrap();
}
}
// client-only stuff for Trunk
else {
pub fn main() {
// This example cannot be built as a trunk standalone CSR-only app.
// Only the server may directly connect to the database.
}
}
// run our app with hyper
// `axum::Server` is a re-export of `hyper::Server`
let listener = tokio::net::TcpListener::bind(&addr).await.unwrap();
log!("listening on http://{}", &addr);
axum::serve(listener, app.into_make_service())
.await
.unwrap();
}

View file

@ -1,23 +1,23 @@
use super::*;
cfg_if! {
if #[cfg(feature="ssr")]{
use oauth2::{
AuthorizationCode,
TokenResponse,
reqwest::async_http_client,
CsrfToken,
Scope,
};
use serde_json::Value;
use crate::{
auth::{User,SqlCsrfToken},
state::AppState
};
}
#[cfg(feature = "ssr")]
pub mod ssr_imports {
pub use crate::{
auth::{ssr_imports::SqlCsrfToken, User},
state::AppState,
};
pub use oauth2::{
reqwest::async_http_client, AuthorizationCode, CsrfToken, Scope,
TokenResponse,
};
pub use serde_json::Value;
}
#[server]
pub async fn google_sso() -> Result<String, ServerFnError> {
use crate::ssr_imports::*;
use ssr_imports::*;
let oauth_client = expect_context::<AppState>().client;
let pool = pool()?;
@ -80,6 +80,9 @@ pub async fn handle_g_auth_redirect(
provided_csrf: String,
code: String,
) -> Result<(String, u64), ServerFnError> {
use crate::ssr_imports::*;
use ssr_imports::*;
let oauth_client = expect_context::<AppState>().client;
let pool = pool()?;
let auth_session = auth()?;
@ -90,9 +93,7 @@ pub async fn handle_g_auth_redirect(
.bind(provided_csrf)
.fetch_one(&pool)
.await
.map_err(|err| {
ServerFnError::ServerError(format!("CSRF_TOKEN error : {err:?}"))
})?;
.map_err(|err| ServerFnError::new(format!("CSRF_TOKEN error : {err:?}")))?;
let token_response = oauth_client
.exchange_code(AuthorizationCode::new(code.clone()))
@ -118,7 +119,7 @@ pub async fn handle_g_auth_redirect(
.expect("email to parse to string")
.to_string()
} else {
return Err(ServerFnError::ServerError(format!(
return Err(ServerFnError::new(format!(
"Response from google has status of {}",
response.status()
)));
@ -193,6 +194,8 @@ pub fn HandleGAuth() -> impl IntoView {
#[server]
pub async fn logout() -> Result<(), ServerFnError> {
use crate::ssr_imports::*;
let auth = auth()?;
auth.logout_user();
leptos_axum::redirect("/");

View file

@ -1,18 +1,12 @@
use cfg_if::cfg_if;
cfg_if! {
if #[cfg(feature = "ssr")] {
use axum::extract::FromRef;
use leptos::LeptosOptions;
use sqlx::SqlitePool;
use axum::extract::FromRef;
/// This takes advantage of Axum's SubStates feature by deriving FromRef. This is the only way to have more than one
/// item in Axum's State. Leptos requires you to have leptosOptions in your State struct for the leptos route handlers
#[derive(FromRef, Debug, Clone)]
pub struct AppState{
pub struct AppState {
pub leptos_options: LeptosOptions,
pub pool: SqlitePool,
pub client:oauth2::basic::BasicClient,
}
}
pub client: oauth2::basic::BasicClient,
}