Documentation

backend/src/cookie/validation.rs

@@ -17,9 +17,10 @@ use crate::{AppState, cookie::jwt::decode_token, handlers::auth::filter_user, mo
 /// Axum middleware to validate a JWT token present in cookies or Authorization header.
 ///
 /// This function extracts a JWT from the request (either from the `token` cookie or
-/// the `Authorization: Bearer` header), decodes and validates it. If valid, it fetches
-/// the corresponding user from the database and inserts a `FilteredUser` into the
-/// request extensions for subsequent handlers to use.
+/// the `Authorization: Bearer` header), decodes and validates it using [`decode_token`](`crate::cookie::jwt::decode_token`)).
+/// If valid, it fetches the corresponding [`User`] from the database and inserts a
+/// [`FilteredUser`](crate::models::FilteredUser)
+/// (converted via [`filter_user`](`crate::handlers::auth::filter_user`)) into the request extensions for subsequent handlers to use.
 ///
 /// If the token is missing, invalid, or the user is not found, it returns an
 /// appropriate error response (401 Unauthorized).
@@ -110,9 +111,10 @@ pub async fn validate_token(
 
 /// Axum middleware to validate JWT token and ensure the authenticated user has admin privileges.
 ///
-/// This middleware first performs all checks of `validate_token`: extracting, decoding,
-/// and validating the JWT, and fetching the associated user from the database.
-/// Additionally, it verifies that the fetched user has `is_admin` set to `true`.
+/// This middleware first performs all checks of [`validate_token`]: extracting, decoding,
+/// and validating the JWT via [`decode_token`](`crate::cookie::jwt::decode_token`), and fetching the associated [`User`] from the database.
+/// Additionally, it verifies that the fetched user has `is_admin` set to `true`. Returns a [`FilteredUser`](crate::models::FilteredUser)
+/// (converted via [`filter_user`](`crate::handlers::auth::filter_user`)) in the request extensions if both authentication and admin status are valid.
 ///
 /// If the user is not authenticated or not an administrator, it returns an
 /// appropriate error response (401 Unauthorized or 403 Forbidden).