fixup: replace editoast_models::User in State by authz::User

Author: Sh099078

editoast/src/authentication.rs

@@ -77,24 +77,17 @@ impl Mode {
 #[derive(Debug, Clone)]
 pub enum State {
     Skip,
-    Authenticated {
-        user: editoast_models::User,
-        roles: Vec<Role>,
-    },
+    Authenticated { user: authz::User, roles: Vec<Role> },
 }
 
 impl State {
-    pub fn user(&self) -> Option<&editoast_models::User> {
+    pub fn user(&self) -> Option<authz::User> {
         match self {
             State::Skip => None,
-            State::Authenticated { user, .. } => Some(user),
+            State::Authenticated { user, .. } => Some(*user),
         }
     }
 
-    pub fn authz_user(&self) -> Option<authz::User> {
-        self.user().map(|user| authz::User(user.id))
-    }
-
     pub fn roles(&self) -> &[Role] {
         static EMPTY_ROLES: [Role; 0] = [];
         match self {
@@ -109,12 +102,9 @@ impl State {
         conn: database::DbConnection,
     ) -> itertools::Either<UserAuthorizer<'a>, SystemAuthorizer<'a>> {
         match self {
-            State::Authenticated { user, roles } => itertools::Either::Left(UserAuthorizer::new(
-                authz::User(user.id),
-                roles.clone(),
-                openfga,
-                conn,
-            )),
+            State::Authenticated { user, roles } => {
+                itertools::Either::Left(UserAuthorizer::new(*user, roles.clone(), openfga, conn))
+            }
             State::Skip => itertools::Either::Right(SystemAuthorizer {
                 openfga,
                 conn: conn.clone(),
@@ -129,7 +119,7 @@ impl State {
     /// [Mode::Impersonating] (in which case it is the impersonated user).
     pub fn try_new(
         mode: Mode,
-        user: Option<editoast_models::User>,
+        user: Option<authz::User>,
         roles: Vec<Role>,
     ) -> Result<Self, AuthorizationError> {
         match mode {

editoast/src/views/authz.rs

@@ -131,10 +131,15 @@ pub(in crate::views) struct WhoamiResponse {
 )]
 pub(in crate::views) async fn whoami(
     Extension(authn_state): Extension<crate::authentication::State>,
+    State(AppState { db_pool, .. }): State<AppState>,
 ) -> Result<Json<WhoamiResponse>> {
     match authn_state {
         crate::authentication::State::Skip => Err(AuthorizationError::Unauthenticated)?,
         crate::authentication::State::Authenticated { user, roles } => {
+            let conn = db_pool.get().await?;
+            let user = editoast_models::User::retrieve(conn, user.0)
+                .await?
+                .expect("user stored in the authorization middleware extension should exist");
             let roles = HashSet::from_iter(roles);
             Ok(Json(WhoamiResponse {
                 id: user.id,
@@ -163,7 +168,7 @@ pub(in crate::views) async fn user_groups(
     }): State<AppState>,
 ) -> Result<Json<Vec<Group>>> {
     let user = authn_state
-        .authz_user()
+        .user()
         .ok_or(AuthorizationError::Unauthenticated)?;
     let authorizer = authn_state.authorizer(regulator.openfga(), db_pool.get().await?);
     let user_groups = authz::v2::user_groups(user)
@@ -383,19 +388,18 @@ pub(in crate::views) async fn user_privileges(
     let mut conn = db_pool.get().await?;
     match &authn_state {
         crate::authentication::State::Authenticated { user, .. } => {
-            let user = authz::User(user.id);
             let resources = resources_ids.into_iter().flat_map(|(resource_type, ids)| {
                 ids.into_iter().map(move |id| match resource_type {
                     ResourceType::Infra => Resource::Infra(authz::Infra(id)),
                     ResourceType::RollingStock => Resource::RollingStock(authz::RollingStock(id)),
                 })
             });
             let protected_privileges = resources.map(|resource| match resource {
-                resource @ Resource::Infra(infra) => v2::infra_privileges(user, infra)
+                resource @ Resource::Infra(infra) => v2::infra_privileges(*user, infra)
                     .collect_into::<HashSet<StandardPrivilege>>()
                     .zip(v2::Protected::value(resource)),
                 resource @ Resource::RollingStock(rolling_stock) => {
-                    v2::rolling_stock_privileges(user, rolling_stock)
+                    v2::rolling_stock_privileges(*user, rolling_stock)
                         .collect_into::<HashSet<StandardPrivilege>>()
                         .zip(v2::Protected::value(resource))
                 }
@@ -528,7 +532,7 @@ pub(in crate::views) async fn user_grants(
     Json(body): Json<HashMap<ResourceType, Vec<i64>>>,
 ) -> Result<Json<HashMap<ResourceType, Vec<UserResourceGrant>>>> {
     let user = authn_state
-        .authz_user()
+        .user()
         .ok_or(AuthorizationError::Unauthenticated)?;
     let authorizer = authn_state.authorizer(regulator.openfga(), db_pool.get().await?);
     let mut response = HashMap::<_, Vec<UserResourceGrant>>::new();

editoast/src/views/infra/mod.rs

@@ -203,7 +203,6 @@ pub(in crate::views) async fn list(
     let settings = match authn {
         crate::authentication::State::Skip => default_settings,
         crate::authentication::State::Authenticated { user, roles } => {
-            let user = authz::User(user.id);
             let authorizer =
                 UserAuthorizer::new(user, roles.clone(), regulator.openfga(), conn.clone());
             let authorized_infras = authorizer

editoast/src/views/server/middlewares.rs

@@ -236,7 +236,8 @@ pub(in crate::views) async fn authentication_validation_middleware(
     span.record("user.roles", tracing::field::debug(&roles));
     span.record("user.is_admin", roles.contains(&Role::Admin));
 
-    let state = crate::authentication::State::try_new(authn, user, roles.clone())?;
+    let authz_user = user.map(|user| authz::User(user.id));
+    let state = crate::authentication::State::try_new(authn, authz_user, roles.clone())?;
     span.record("authz.state", tracing::field::debug(&state));
     req.extensions_mut().insert(state);
     req.extensions_mut().remove::<crate::authentication::Mode>();