Put some api calls behind admin access

Sidebar fix
Styles now actually get applied and sidebar doesn't block content Also the login page doesn't have a sidebar now
2026-05-02 19:15:40 +02:00 · 2026-05-02 19:09:41 +02:00
8 changed files with 159 additions and 15 deletions
@@ -93,3 +93,86 @@ pub async fn validate_token(
    request.extensions_mut().insert(filter_user(&user));
    Ok(next.run(request).await)
 }
 pub async fn validate_admin(
    cookies: CookieJar,
    State(data): State<Arc<AppState>>,
    mut request: Request<Body>,
    next: Next,
 ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    let token = cookies
        .get("token")
        .map(|cookie| cookie.value().to_string())
        .or_else(|| {
            request
                .headers()
                .get(header::AUTHORIZATION)
                .and_then(|header| header.to_str().ok())
                .and_then(|value| {
                    if value.starts_with("Bearer ") {
                        Some(value[7..].to_owned())
                    } else {
                        None
                    }
                })
        });
    let token = token.ok_or_else(|| {
        let error = json!({
            "status": "error",
            "message": "Please provide a valid token"
        });
        (StatusCode::UNAUTHORIZED, Json(error))
    })?;
    let claims = decode_token(
        token,
        &DecodingKey::from_secret(data.env.token_secret.as_ref()),
    )
    .map_err(|(status, json_err)| {
        let error = json!({
            "status": json_err.status,
            "message": json_err.message
        });
        (status, Json(error))
    })?;
    let uuid = (&claims.sub).parse::<i16>().map_err(|_| {
        let error = json!({
            "status": "error",
            "message": "Invalid user id"
        });
        (StatusCode::UNAUTHORIZED, Json(error))
    })?;
    let user = sqlx::query_as::<_, User>(r#"SELECT * FROM users WHERE id = $1"#)
        .bind(uuid)
        .fetch_optional(&data.db)
        .await
        .map_err(|e| {
            let error = json!({
                "status": "error",
                "message": format!("Database error: {}", e)
            });
            (StatusCode::INTERNAL_SERVER_ERROR, Json(error))
        })?;
    let user = user.ok_or_else(|| {
        let error = json!({
            "status": "error",
            "message": "Invalid user"
        });
        (StatusCode::UNAUTHORIZED, Json(error))
    })?;
    if !user.is_admin {
        let error = json!({
            "status": "error",
            "message": "Admin access required"
        });
        return Err((StatusCode::FORBIDDEN, Json(error)));
    }
    request.extensions_mut().insert(filter_user(&user));
    Ok(next.run(request).await)
 }
@@ -7,7 +7,7 @@ use axum::{
 use crate::{
    AppState,
-    cookie::validation::validate_token,
+    cookie::validation::{validate_admin, validate_token},
    handlers::{
        auth::{
            create_user, delete_user, get_current_user, get_user_by_id, get_users, login, logout,
@@ -18,9 +18,7 @@ use crate::{
 };
 pub fn create_router(state: Arc<AppState>) -> Router {
-    let protected_routes = Router::new()
+    let admin_routes = Router::new()
        .route("/api/tickets", get(get_tickets))
        .route("/api/tickets/create", post(create_ticket))
        .route(
            "/api/tickets/{id}",
            get(get_ticket_by_id)
@@ -28,13 +26,22 @@ pub fn create_router(state: Arc<AppState>) -> Router {
                .patch(edit_ticket),
        )
        .route("/api/register", post(create_user))
        .route("/api/logout", get(logout))
        .route("/api/users", get(get_users))
        .route("/api/users/current", get(get_current_user))
        .route(
            "/api/users/{id}",
            get(get_user_by_id).delete(delete_user).patch(update_user),
        )
        .layer(middleware::from_fn_with_state(
            state.clone(),
            validate_admin,
        ));
    let protected_routes = Router::new()
        .merge(admin_routes)
        .route("/api/tickets", get(get_tickets))
        .route("/api/tickets/create", post(create_ticket))
        .route("/api/logout", get(logout))
        .layer(middleware::from_fn_with_state(
            state.clone(),
            validate_token,
@@ -3,7 +3,7 @@
 <head>
    <link data-trunk rel="rust" data-bin="bin" />
-    <link rel="scss" href="src/styles/main.scss" />
+    <link data-trunk rel="scss" href="src/styles/main.scss" />
    <meta charset="utf-8" />
    <title>Yew App</title>
 </head>
@@ -32,49 +32,82 @@ enum Route {
    NotFound,
 }
 #[derive(Properties, PartialEq)]
 pub struct SidebarShellProps {
    pub children: Children,
 }
 #[component(SidebarShell)]
 fn sidebar_shell(props: &SidebarShellProps) -> Html {
    html! {
        <div class="layout">
            <sidebar::Sidebar/>
            <main class="content">
                { for props.children.iter() }
            </main>
        </div>
    }
 }
 fn switch(route: Route) -> Html {
    match route {
        Route::Home => html! {
            <ProtectedRoute admin_page={false}>
                <SidebarShell>
                    <basic_pages::Home/>
                </SidebarShell>
            </ProtectedRoute>
        },
        Route::NotFound => html! { <basic_pages::NotFound/> },
        Route::Ticket => html! {
            <ProtectedRoute admin_page={false}>
                <SidebarShell>
                    <ticket::SubmitTicket/>
                </SidebarShell>
            </ProtectedRoute>
        },
        Route::TicketById { id } => html! {
            <ProtectedRoute admin_page={true}>
                <SidebarShell>
                    <ticket::TicketByID {id}/>
                </SidebarShell>
            </ProtectedRoute>
        },
        Route::AllTickets => html! {
            <ProtectedRoute admin_page={false}>
                <SidebarShell>
                    <ticket::AllTickets/>
                </SidebarShell>
            </ProtectedRoute>
        },
        Route::Register => html! {
            <ProtectedRoute admin_page={true}>
                <SidebarShell>
                    <user::Register/>
                </SidebarShell>
            </ProtectedRoute>
        },
        Route::Login => html! { <user::Login/> },
        Route::AllUsers => html! {
            <ProtectedRoute admin_page={true}>
                <SidebarShell>
                    <user::AllUsers/>
                </SidebarShell>
            </ProtectedRoute>
        },
        Route::UserByID { id } => html! {
            <ProtectedRoute admin_page={true}>
                <SidebarShell>
                    <user::UserByID {id}/>
                </SidebarShell>
            </ProtectedRoute>
        },
        Route::PermissionDenied => html! { <basic_pages::PermissionDenied/> },
        Route::Diagnostics => html! {
            <ProtectedRoute admin_page={true}>
                <SidebarShell>
                    <utilities::Diagnostics/>
                </SidebarShell>
            </ProtectedRoute>
        },
    }
@@ -84,7 +117,6 @@ fn switch(route: Route) -> Html {
 pub fn app() -> Html {
    html! {
        <BrowserRouter>
            <sidebar::Sidebar/>
            <Switch<Route> render={switch} />
        </BrowserRouter>
    }
@@ -1,3 +1,5 @@
@use "variables" as *;
@mixin card {
  backgroud: #fff;
  border-radius: &border-radius;
@@ -1,3 +1,5 @@
@use "variables" as *;
 .u-hidden { display: none !important; }
 .u-gap-sm { gap: $spacing-sm; }
 .text-muted { color: $color-muted; }
@@ -1,3 +1,6 @@
@use "../mixins" as *;
@use "../variables" as *;
 .ticket-card {
  @include card();
  border-left: 4px solid $color-accent;
@@ -14,6 +14,21 @@ body {
 .admin { display: flex; }
 .content { flex: 1; padding: variables.$spacing-md; }
 .layout {
    display: flex;
    min-height: 100vh;
 }
 .sidebar {
    width: 260px;
    flex-shrink: 0;
 }
 .content {
    flex: 1;
    min-width: 0;
 }
@media (max-width: 768px) {
  .sidebar { position: fixed; left: -100%; transition: left .2s; }
  .sidebar.open { left: 0; }
Author	SHA1	Message	Date
schn33fuchs	654b55a2a4	Put some api calls behind admin access	2026-05-02 19:15:40 +02:00
schn33fuchs	931bd27c65	Sidebar fix Styles now actually get applied and sidebar doesn't block content Also the login page doesn't have a sidebar now	2026-05-02 19:09:41 +02:00