Refactoring to move authentication out of the ResourceService layer

crates/caldav/src/calendar/resource.rs

@@ -3,7 +3,6 @@ use crate::Error;
 use actix_web::{web::Data, HttpRequest};
 use async_trait::async_trait;
 use derive_more::derive::{From, Into};
-use rustical_auth::AuthInfo;
 use rustical_dav::resource::{InvalidProperty, Resource, ResourceService};
 use rustical_dav::xml::HrefElement;
 use rustical_store::calendar::Calendar;
@@ -224,7 +223,10 @@ impl<C: CalendarStore + ?Sized> ResourceService for CalendarResourceService<C> {
     type Resource = CalendarResource;
     type Error = Error;
 
-    async fn get_resource(&self) -> Result<Self::Resource, Error> {
+    async fn get_resource(&self, principal: String) -> Result<Self::Resource, Error> {
+        if self.principal != principal {
+            return Err(Error::Unauthorized);
+        }
         let calendar = self
             .cal_store
             .read()
@@ -235,10 +237,7 @@ impl<C: CalendarStore + ?Sized> ResourceService for CalendarResourceService<C> {
         Ok(calendar.into())
     }
 
-    async fn get_members(
-        &self,
-        _auth_info: AuthInfo,
-    ) -> Result<Vec<(String, Self::MemberType)>, Self::Error> {
+    async fn get_members(&self) -> Result<Vec<(String, Self::MemberType)>, Self::Error> {
         // As of now the calendar resource has no members since events are shown with REPORT
         Ok(self
             .cal_store
@@ -253,7 +252,6 @@ impl<C: CalendarStore + ?Sized> ResourceService for CalendarResourceService<C> {
 
     async fn new(
         req: &HttpRequest,
-        auth_info: &AuthInfo,
         path_components: Self::PathComponents,
     ) -> Result<Self, Self::Error> {
         let cal_store = req
@@ -264,7 +262,7 @@ impl<C: CalendarStore + ?Sized> ResourceService for CalendarResourceService<C> {
 
         Ok(Self {
             path: req.path().to_owned(),
-            principal: auth_info.user_id.to_owned(),
+            principal: path_components.0,
             calendar_id: path_components.1,
             cal_store,
         })

crates/caldav/src/event/resource.rs

@@ -2,7 +2,6 @@ use crate::Error;
 use actix_web::{web::Data, HttpRequest};
 use async_trait::async_trait;
 use derive_more::derive::{From, Into};
-use rustical_auth::AuthInfo;
 use rustical_dav::resource::{InvalidProperty, Resource, ResourceService};
 use rustical_store::event::Event;
 use rustical_store::CalendarStore;
@@ -72,7 +71,6 @@ impl<C: CalendarStore + ?Sized> ResourceService for EventResourceService<C> {
 
     async fn new(
         req: &HttpRequest,
-        _auth_info: &AuthInfo,
         path_components: Self::PathComponents,
     ) -> Result<Self, Self::Error> {
         let (principal, cid, mut uid) = path_components;
@@ -96,7 +94,10 @@ impl<C: CalendarStore + ?Sized> ResourceService for EventResourceService<C> {
         })
     }
 
-    async fn get_resource(&self) -> Result<Self::Resource, Self::Error> {
+    async fn get_resource(&self, principal: String) -> Result<Self::Resource, Self::Error> {
+        if self.principal != principal {
+            return Err(Error::Unauthorized);
+        }
         let event = self
             .cal_store
             .read()

crates/caldav/src/principal/mod.rs

@@ -2,7 +2,6 @@ use crate::Error;
 use actix_web::web::Data;
 use actix_web::HttpRequest;
 use async_trait::async_trait;
-use rustical_auth::AuthInfo;
 use rustical_dav::resource::{InvalidProperty, Resource, ResourceService};
 use rustical_dav::xml::HrefElement;
 use rustical_store::CalendarStore;
@@ -93,12 +92,8 @@ impl<C: CalendarStore + ?Sized> ResourceService for PrincipalResourceService<C>
 
     async fn new(
         req: &HttpRequest,
-        auth_info: &AuthInfo,
         (principal,): Self::PathComponents,
     ) -> Result<Self, Self::Error> {
-        if auth_info.user_id != principal {
-            return Err(Error::Unauthorized);
-        }
         let cal_store = req
             .app_data::<Data<RwLock<C>>>()
             .expect("no calendar store in app_data!")
@@ -112,16 +107,16 @@ impl<C: CalendarStore + ?Sized> ResourceService for PrincipalResourceService<C>
         })
     }
 
-    async fn get_resource(&self) -> Result<Self::Resource, Self::Error> {
+    async fn get_resource(&self, principal: String) -> Result<Self::Resource, Self::Error> {
+        if self.principal != principal {
+            return Err(Error::Unauthorized);
+        }
         Ok(PrincipalResource {
             principal: self.principal.to_owned(),
         })
     }
 
-    async fn get_members(
-        &self,
-        _auth_info: AuthInfo,
-    ) -> Result<Vec<(String, Self::MemberType)>, Self::Error> {
+    async fn get_members(&self) -> Result<Vec<(String, Self::MemberType)>, Self::Error> {
         let calendars = self
             .cal_store
             .read()

crates/caldav/src/root/mod.rs

@@ -1,15 +1,12 @@
 use crate::Error;
 use actix_web::HttpRequest;
 use async_trait::async_trait;
-use rustical_auth::AuthInfo;
 use rustical_dav::resource::{InvalidProperty, Resource, ResourceService};
 use rustical_dav::xml::HrefElement;
 use serde::{Deserialize, Serialize};
 use strum::{EnumString, VariantNames};
 
-pub struct RootResourceService {
-    principal: String,
-}
+pub struct RootResourceService;
 
 #[derive(EnumString, Debug, VariantNames, Clone)]
 #[strum(serialize_all = "kebab-case")]
@@ -42,7 +39,7 @@ impl InvalidProperty for RootProp {
 
 #[derive(Clone)]
 pub struct RootResource {
-    pub principal: String,
+    principal: String,
 }
 
 impl Resource for RootResource {
@@ -69,18 +66,13 @@ impl ResourceService for RootResourceService {
 
     async fn new(
         _req: &HttpRequest,
-        auth_info: &AuthInfo,
         _path_components: Self::PathComponents,
     ) -> Result<Self, Self::Error> {
-        Ok(Self {
-            principal: auth_info.user_id.to_owned(),
-        })
+        Ok(Self)
     }
 
-    async fn get_resource(&self) -> Result<Self::Resource, Self::Error> {
-        Ok(RootResource {
-            principal: self.principal.to_owned(),
-        })
+    async fn get_resource(&self, principal: String) -> Result<Self::Resource, Self::Error> {
+        Ok(RootResource { principal })
     }
 
     async fn save_resource(&self, _file: Self::Resource) -> Result<(), Self::Error> {

crates/dav/src/methods/delete.rs

@@ -3,14 +3,12 @@ use actix_web::web::Path;
 use actix_web::HttpRequest;
 use actix_web::HttpResponse;
 use actix_web::Responder;
-use rustical_auth::{AuthInfoExtractor, CheckAuthentication};
+use rustical_auth::CheckAuthentication;
 
 pub async fn route_delete<A: CheckAuthentication, R: ResourceService>(
     path_components: Path<R::PathComponents>,
     req: HttpRequest,
-    auth: AuthInfoExtractor<A>,
 ) -> Result<impl Responder, R::Error> {
-    let auth_info = auth.inner;
     let path_components = path_components.into_inner();
 
     let no_trash = req
@@ -19,7 +17,7 @@ pub async fn route_delete<A: CheckAuthentication, R: ResourceService>(
         .map(|val| matches!(val.to_str(), Ok("1")))
         .unwrap_or(false);
 
-    let resource_service = R::new(&req, &auth_info, path_components.clone()).await?;
+    let resource_service = R::new(&req, path_components.clone()).await?;
     resource_service.delete_resource(!no_trash).await?;
 
     Ok(HttpResponse::Ok().body(""))

crates/dav/src/methods/propfind.rs

@@ -54,11 +54,10 @@ pub async fn route_propfind<A: CheckAuthentication, R: ResourceService>(
     R::Error,
 > {
     debug!("{body}");
-    let auth_info = auth.inner;
     let prefix = prefix.into_inner();
     let path = req.path().to_owned();
 
-    let resource_service = R::new(&req, &auth_info, path_components.into_inner()).await?;
+    let resource_service = R::new(&req, path_components.into_inner()).await?;
 
     // A request body is optional. If empty we MUST return all props
     let propfind: PropfindElement = if !body.is_empty() {
@@ -83,12 +82,12 @@ pub async fn route_propfind<A: CheckAuthentication, R: ResourceService>(
 
     let mut member_responses = Vec::new();
     if depth != Depth::Zero {
-        for (path, member) in resource_service.get_members(auth_info).await? {
+        for (path, member) in resource_service.get_members().await? {
             member_responses.push(member.propfind(&prefix, path, props.clone()).await?);
         }
     }
 
-    let resource = resource_service.get_resource().await?;
+    let resource = resource_service.get_resource(auth.inner.user_id).await?;
     let response = resource.propfind(&prefix, path, props).await?;
 
     Ok(MultistatusElement {

crates/dav/src/methods/proppatch.rs

@@ -53,10 +53,9 @@ pub async fn route_proppatch<A: CheckAuthentication, R: ResourceService>(
     req: HttpRequest,
     auth: AuthInfoExtractor<A>,
 ) -> Result<MultistatusElement<PropstatWrapper<String>, PropstatWrapper<String>>, R::Error> {
-    let auth_info = auth.inner;
     let path_components = path.into_inner();
     let href = req.path().to_owned();
-    let resource_service = R::new(&req, &auth_info, path_components.clone()).await?;
+    let resource_service = R::new(&req, path_components.clone()).await?;
 
     debug!("{body}");
 
@@ -76,7 +75,7 @@ pub async fn route_proppatch<A: CheckAuthentication, R: ResourceService>(
         })
         .collect();
 
-    let mut resource = resource_service.get_resource().await?;
+    let mut resource = resource_service.get_resource(auth.inner.user_id).await?;
 
     let mut props_ok = Vec::new();
     let mut props_conflict = Vec::new();

crates/dav/src/resource.rs

@@ -5,7 +5,6 @@ use actix_web::{http::StatusCode, HttpRequest, ResponseError};
 use async_trait::async_trait;
 use core::fmt;
 use itertools::Itertools;
-use rustical_auth::AuthInfo;
 use serde::{Deserialize, Serialize};
 use std::str::FromStr;
 use strum::VariantNames;
@@ -47,18 +46,14 @@ pub trait ResourceService: Sized {
 
     async fn new(
         req: &HttpRequest,
-        auth_info: &AuthInfo,
         path_components: Self::PathComponents,
     ) -> Result<Self, Self::Error>;
 
-    async fn get_members(
-        &self,
-        _auth_info: AuthInfo,
-    ) -> Result<Vec<(String, Self::MemberType)>, Self::Error> {
+    async fn get_members(&self) -> Result<Vec<(String, Self::MemberType)>, Self::Error> {
         Ok(vec![])
     }
 
-    async fn get_resource(&self) -> Result<Self::Resource, Self::Error>;
+    async fn get_resource(&self, principal: String) -> Result<Self::Resource, Self::Error>;
     async fn save_resource(&self, file: Self::Resource) -> Result<(), Self::Error>;
     async fn delete_resource(&self, _use_trashbin: bool) -> Result<(), Self::Error> {
         Err(crate::Error::Unauthorized.into())