Function jwt_auth

crates/signer/src/service.rs:138–166

Authentication middleware layer

(
    State(state): State<SigningState>,
    TypedHeader(auth): TypedHeader<Authorization<Bearer>>,
    addr: ConnectInfo<SocketAddr>,
    mut req: Request,
    next: Next,
)

/// Authentication middleware layer
async fn jwt_auth(
    State(state): State<SigningState>,
    TypedHeader(auth): TypedHeader<Authorization<Bearer>>,
    addr: ConnectInfo<SocketAddr>,
    mut req: Request,
    next: Next,
) -> Result<Response, SignerModuleError> {
    // Check if the request needs to be rate limited
    let client_ip = addr.ip();
    check_jwt_rate_limit(&state, &client_ip)?;

    // Process JWT authorization
    match check_jwt_auth(&auth, &state) {
        Ok(module_id) => {
            req.extensions_mut().insert(module_id);
            Ok(next.run(req).await)
        }
        Err(SignerModuleError::Unauthorized) => {
            let mut failures = state.jwt_auth_failures.write();
            let failure_info = failures
                .entry(client_ip)
                .or_insert(JwtAuthFailureInfo { failure_count: 0, last_failure: Instant::now() });
            failure_info.failure_count += 1;
            failure_info.last_failure = Instant::now();
            Err(SignerModuleError::Unauthorized)
        }
        Err(err) => Err(err),
    }
}

/// Checks if the incoming request needs to be rate limited due to previous JWT
/// authentication failures