Function encrypt_payloads

middleware/encrypted-payloads/src/main.rs:88–157

(
    mut req: dev::ServiceRequest,
    next: Next<impl MessageBody>,
)

}

async fn encrypt_payloads(
    mut req: dev::ServiceRequest,
    next: Next<impl MessageBody>,
) -> Result<dev::ServiceResponse<impl MessageBody>, Error> {
    // get cipher from app data
    let cipher = req.extract::<web::Data<Aes256GcmSiv>>().await.unwrap();

    // extract JSON with encrypted+encoded data field
    let Json(Req { id, nonce, data }) = req.extract::<Json<Req>>().await?;

    log::info!("decrypting request {id:?}");

    // decode nonce from payload
    let nonce = BASE64_STANDARD.decode(nonce.unwrap()).unwrap();
    let nonce = Nonce::from_slice(&nonce);

    // decode and decrypt data field
    let data_enc = BASE64_STANDARD.decode(&data).unwrap();
    let data = cipher.decrypt(nonce, data_enc.as_slice()).unwrap();

    // construct request body format with plaintext data
    let req_body = Req {
        id,
        nonce: None,
        data: String::from_utf8(data).unwrap(),
    };

    // encode request body as JSON
    let req_body = serde_json::to_vec(&req_body).unwrap();

    // re-insert request body
    req.set_payload(bytes_to_payload(web::Bytes::from(req_body)));

    // call next service
    let res = next.call(req).await?;

    log::info!("encrypting response {id:?}");

    // deconstruct response into parts
    let (req, res) = res.into_parts();
    let (res, body) = res.into_parts();

    // Read all bytes out of response stream. Only use `to_bytes` if you can guarantee all handlers
    // wrapped by this middleware return complete responses or bounded streams.
    let body = body::to_bytes(body).await.ok().unwrap();

    // parse JSON from response body
    let Res { data, .. } = serde_json::from_slice(&body).unwrap();

    // generate and encode nonce for later
    let nonce = Nonce::from_slice(b"unique nonce");
    let nonce_b64 = Some(BASE64_STANDARD.encode(nonce));

    // encrypt and encode data field
    let data_enc = cipher.encrypt(nonce, data.as_bytes()).unwrap();
    let data_enc = BASE64_STANDARD.encode(data_enc);

    // re-pack response into JSON format