Access Control for Salvo

[greenpdx]

I have different sections of a web app that require different access for different roles.

I would like to see a module that can define access to different section of a web app, The rest/rpc areas validates session data to determine access to a call.

I am using salvo because it is embedded in a mqtt server and to reduce space and have the web pages effect the mqtt server. use a separate web sever
actix-web

Additional context
Add any other context or screenshots about the feature request here.

[chrislearn]

I'm not sure how other web frameworks do it, but in Salvo, you can use middleware to define the permissions for each route and its sub-routes.

[greenpdx]

Is that middelware available? where is the code?

[josejachuf]

something like this should work:

//middleware
#[handler]
pub async fn validate_role(req: &mut Request, depot: &mut Depot, res: &mut Response) {
let user_key = req.query::("key").unwrap_or("".to_string());

let role = depot.obtain::<role>().unwrap();
let user = depot.obtain::<user>().unwrap();

// pseudocode     
if role not in user.roles {
    return forbidden
}

}

in router:
Router::with_path("foo")
.hoop(affix::insert("role", "admin"))
.hoop(affix::insert("user", user))
.hoop(auth::validate_role)
.push(Router::with_path("").get(bar::get_all))

[chrislearn]

1. I never said "two roles is enough for all use cases.".
2. Please give other frameworks example, Maybe I don't understand what kind of functionality you want.

[greenpdx]

That good. You are using role as access control, but it hard coded //middleware
I would like dynamic configuration access control.
I think you are better at rust than I am.
in the config file define the acl
path, method, role, action (forbid, allow, redirect, function)
I have two function read config to depot.access_role

Then in validate_role reads depot.access_role and req.path and user from session and does the action.

#[handler]
pub async fn validate_role(req: &mut Request, depot: &mut Depot, res: &mut Response) {
let user_key = req.query::("key").unwrap_or("".to_string());
let access_role = path2access(req, depot) // translate path to role or

let user = depot.obtain::().unwrap();
// pseudocode
if access_role not in user.roles {
return forbidden
}

#[handler] // read config and setup access control for each path
pub async fn access_cfg(cfg, depot) {
if not depot.access_role {
read config
depot.access_role from config
}
}

in router:
Router::new()
.hoop(auth::access_cfg)
.hoop(auth::validate_role)
.push(Router::with_path("foo").get(bar::get_all))

[prabirshrestha]

You can try integrating https://github.com/casbin/casbin-rs or https://github.com/cedar-policy/cedar

[greenpdx]

I will look at them