Usage of AsyncRequireAuthorizationLayer with Axum

[bwolf]

I'm sorry but I'm trying to figure out how to use tower_http/AsyncRequireAuthorizationLayer toger with axum. I'm not sure how to post the code in question, so I do it inline here (do you prefer a gist or a separate repo?):

use axum::{http::Request, response::Response, routing::get, BoxError, Router};
use http::StatusCode;
use std::fmt;
use tower::ServiceBuilder;
use tower_http::{auth::AsyncRequireAuthorizationLayer, trace::TraceLayer};

#[derive(Debug)]
struct UserId(String);

#[derive(Debug)]
struct AuthError;

impl fmt::Display for AuthError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.pad("authorization failed")
    }
}

impl std::error::Error for AuthError {}

async fn check_auth<B>(request: &http::Request<B>) -> Option<UserId> {
    Some(UserId(String::from("Dummy User")))
}

async fn handle_auth_error(err: BoxError) -> (StatusCode, String) {
    if err.is::<AuthError>() {
        (StatusCode::UNAUTHORIZED, "Unauthorized".to_string())
    } else {
        (
            StatusCode::INTERNAL_SERVER_ERROR,
            "Internal server error".to_string(),
        )
    }
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    tracing_subscriber::fmt::init();

    let app: Router = Router::new().route("/", get(|| async { "Hello, World!" }));

    let app = app.route_layer(
        ServiceBuilder::new()
            .layer(TraceLayer::new_for_http())
            //.layer(HandleErrorLayer::new(handle_auth_error))
            .layer(AsyncRequireAuthorizationLayer::new(
                |request: Request<_>| async move {
                    // TODO: 1. Returning an Error, together with HandleErrorLayer does not work:
                    // return Err(AuthError)
                    // TODO: 2. Returning a Response does not work, either as result, nor plain:
                    let res = Response::builder()
                        .status(StatusCode::UNAUTHORIZED)
                        .body(http_body::combinators::UnsyncBoxBody::new(
                            http_body::Empty::new(),
                        ))
                        .unwrap();

                    // It seems AuthHandler in tower_http::auth expects this,
                    // but axum not.
                    let xxx: Result<Request<_>, Response<_>> = Err(res);
                    xxx
                },
            )),
    );

    axum::Server::bind(&"0.0.0.0:8080".parse().unwrap())
        .serve(app.into_make_service())
        .await
        .unwrap();

    Ok(())
}

The errors are really ugly in this case:

error[E0271]: type mismatch resolving `<impl std::future::Future<Output = Result<Request<axum::body::Body>, Response<UnsyncBoxBody<_, Infallible>>>> as std::future::Future>::Output == Result<Request<_>, Response<UnsyncBoxBody<axum::body::Bytes, axum::Error>>>`
  --> authplay/src/main.rs:42:19
   |
42 |     let app = app.route_layer(
   |                   ^^^^^^^^^^^ expected enum `Infallible`, found struct `axum::Error`
   |
   = note: expected enum `Result<Request<axum::body::Body>, Response<UnsyncBoxBody<_, Infallible>>>`
              found enum `Result<Request<_>, Response<UnsyncBoxBody<axum::body::Bytes, axum::Error>>>`
   = note: required because of the requirements on the impl of `AsyncAuthorizeRequest<axum::body::Body>` for `[closure@authplay/src/main.rs:47:17: 47:38]`
   = note: required because of the requirements on the impl of `Service<Request<axum::body::Body>>` for `AsyncRequireAuthorization<Route, [closure@authplay/src/main.rs:47:17: 47:38]>`
   = note: 1 redundant requirement hidden
   = note: required because of the requirements on the impl of `Service<Request<axum::body::Body>>` for `Trace<AsyncRequireAuthorization<Route, [closure@authplay/src/main.rs:47:17: 47:38]>, SharedClassifier<ServerErrorsAsFailures>>`

error[E0271]: type mismatch resolving `<impl std::future::Future<Output = Result<Request<axum::body::Body>, Response<UnsyncBoxBody<_, Infallible>>>> as std::future::Future>::Output == Result<Request<_>, Response<UnsyncBoxBody<axum::body::Bytes, axum::Error>>>`
  --> authplay/src/main.rs:42:19
   |
42 |     let app = app.route_layer(
   |                   ^^^^^^^^^^^ expected enum `Infallible`, found struct `axum::Error`
   |
   = note: expected enum `Result<Request<axum::body::Body>, Response<UnsyncBoxBody<_, Infallible>>>`
              found enum `Result<Request<_>, Response<UnsyncBoxBody<axum::body::Bytes, axum::Error>>>`
   = note: required because of the requirements on the impl of `AsyncAuthorizeRequest<axum::body::Body>` for `[closure@authplay/src/main.rs:47:17: 47:38]`
   = note: required because of the requirements on the impl of `Service<Request<axum::body::Body>>` for `AsyncRequireAuthorization<Route, [closure@authplay/src/main.rs:47:17: 47:38]>`

For more information about this error, try `rustc --explain E0271`.
error: could not compile `authplay` due to 2 previous errors

If I switch over returning an error, the errors change to:

error[E0271]: type mismatch resolving `<impl std::future::Future<Output = Result<_, AuthError>> as std::future::Future>::Output == Result<Request<Body>, Response<_>>`
  --> authplay/src/main.rs:42:19
   |
42 |     let app = app.route_layer(
   |                   ^^^^^^^^^^^ expected struct `AuthError`, found struct `Response`
   |

What I'm doing wrong here?

[davidpdrsn]

I'd recommend you use https://docs.rs/axum/0.6.0-rc.1/axum/middleware/fn.from_fn.html instead.

[bwolf]

Thank you for the quick reply. I already did this, but now I want to share the middleware accross projects and thought I generify it. I found a solution for my use case using a Service plus tower_http::auth::RequireAuthorizationLayer.