eric / rustwarden

/// API Middleware Module
///
/// Middleware for the Rustwarden API.
/// Extractor for admin identity from request extensions.
pub mod admin_extractor;
/// Helper utilities for admin middleware.
pub mod admin_helper;
/// Middleware that rejects non-admin requests.
pub mod admin_required;
/// Service layer for admin-specific operations used by middleware.
pub mod admin_service;
/// Middleware that rejects unauthenticated requests.
pub mod auth_required;
/// Service layer for authentication checks used by middleware.
pub mod auth_service;
/// CSRF token generation and validation middleware.
///
/// Key entry points: [`crate::middleware::csrf::csrf_protection`],
/// [`crate::middleware::csrf::csrf_protection_with_config`],
/// and [`crate::middleware::csrf::CsrfProtectionConfig`].
///
/// Wiring: `RustwardenBuilder::build` applies
/// [`crate::middleware::csrf::csrf_protection_with_config`]
/// (`accept_form_body = true`) to the **browser** router only — the family
/// fed by `with_ui` / `merge_browser_routes` / `merge_routes`. The **machine**
/// router (`merge_machine_routes`, OAuth callbacks, the ActivityPub inbox) is
/// never covered, so HTTP-signature and Bearer endpoints are not subject to
/// CSRF. The CSRF layer is internal to the browser sub-router while the
/// `session_layer` is global, guaranteeing the session is available when the
/// CSRF check runs. See `docs/plans/2026-06-04-csrf-protection-structurelle.md`.
pub mod csrf;
/// Centralized error handling middleware that maps errors to structured responses.
pub mod error_handler;
/// Middleware that validates password complexity requirements.
pub mod password_complexity;
/// Token-bucket rate limiting middleware.
pub mod rate_limit;
/// Trait consulted by `AuthService` to refuse revoked remote JWTs
/// (implemented and injected by `rustwarden-fediverse`).
pub mod revocation;
/// Middleware that updates the user's last-login timestamp on successful requests.
pub mod update_last_login;