Administrator privileges to get and delete subscribers

migrations/20250930145931_add_role_to_users.sql

@@ -0,0 +1,7 @@
+CREATE TYPE user_role AS ENUM ('admin', 'writer');
+
+ALTER TABLE users ADD COLUMN role user_role;
+
+UPDATE users SET role = 'admin' WHERE role IS NULL;
+
+ALTER TABLE users ALTER COLUMN role SET NOT NULL;

src/authentication.rs

@@ -1,12 +1,9 @@
-use crate::{
+use crate::telemetry::spawn_blocking_with_tracing;
-    routes::AdminError, session_state::TypedSession, telemetry::spawn_blocking_with_tracing,
-};
 use anyhow::Context;
 use argon2::{
     Algorithm, Argon2, Params, PasswordHash, PasswordHasher, PasswordVerifier, Version,
     password_hash::{SaltString, rand_core::OsRng},
 };
-use axum::{extract::Request, middleware::Next, response::Response};
 use secrecy::{ExposeSecret, SecretString};
 use sqlx::PgPool;
 use uuid::Uuid;
@@ -60,8 +57,9 @@ fn compute_pasword_hash(password: SecretString) -> Result<SecretString, anyhow::
 pub async fn validate_credentials(
     Credentials { username, password }: Credentials,
     connection_pool: &PgPool,
-) -> Result<Uuid, AuthError> {
+) -> Result<(Uuid, Role), AuthError> {
     let mut user_id = None;
+    let mut role = None;
     let mut expected_password_hash = SecretString::from(
         "$argon2id$v=19$m=15000,t=2,p=1$\
 gZiV/M1gPc22ElAH/Jh1Hw$\
@@ -69,13 +67,14 @@ CWOrkoo7oJBQ/iyh7uJ0LO2aLEfrHwTWllSAxT0zRno"
             .to_string(),
     );
 
-    if let Some((stored_user_id, stored_expected_password_hash)) =
+    if let Some((stored_user_id, stored_expected_password_hash, stored_role)) =
         get_stored_credentials(&username, connection_pool)
             .await
             .context("Failed to retrieve credentials from database.")
             .map_err(AuthError::UnexpectedError)?
     {
         user_id = Some(stored_user_id);
+        role = Some(stored_role);
         expected_password_hash = stored_expected_password_hash;
     }
 
@@ -86,12 +85,16 @@ CWOrkoo7oJBQ/iyh7uJ0LO2aLEfrHwTWllSAxT0zRno"
         .ok_or_else(|| anyhow::anyhow!("Unknown username."))
         .map_err(AuthError::InvalidCredentials)?;
 
+    let role = role
+        .ok_or_else(|| anyhow::anyhow!("Unknown role."))
+        .map_err(AuthError::UnexpectedError)?;
+
     handle
         .await
         .context("Failed to spawn blocking task.")
         .map_err(AuthError::UnexpectedError)?
         .map_err(AuthError::InvalidCredentials)
-        .map(|_| uuid)
+        .map(|_| (uuid, role))
 }
 
 #[tracing::instrument(name = "Verify password", skip_all)]
@@ -113,10 +116,10 @@ fn verify_password_hash(
 async fn get_stored_credentials(
     username: &str,
     connection_pool: &PgPool,
-) -> Result<Option<(Uuid, SecretString)>, sqlx::Error> {
+) -> Result<Option<(Uuid, SecretString, Role)>, sqlx::Error> {
     let row = sqlx::query!(
         r#"
-        SELECT user_id, password_hash
+        SELECT user_id, password_hash, role as "role: Role"
         FROM users
         WHERE username = $1
         "#,
@@ -124,37 +127,26 @@ async fn get_stored_credentials(
     )
     .fetch_optional(connection_pool)
     .await?
-    .map(|row| (row.user_id, SecretString::from(row.password_hash)));
+    .map(|row| (row.user_id, SecretString::from(row.password_hash), row.role));
     Ok(row)
 }
 
-pub async fn require_auth(
+#[derive(serde::Serialize, serde::Deserialize, Debug, Clone, Copy, PartialEq, Eq, sqlx::Type)]
-    session: TypedSession,
+#[sqlx(type_name = "user_role", rename_all = "lowercase")]
-    mut request: Request,
+pub enum Role {
-    next: Next,
+    Admin,
-) -> Result<Response, AdminError> {
+    Writer,
-    let user_id = session
-        .get_user_id()
-        .await
-        .map_err(|e| AdminError::UnexpectedError(e.into()))?
-        .ok_or(AdminError::NotAuthenticated)?;
-    let username = session
-        .get_username()
-        .await
-        .map_err(|e| AdminError::UnexpectedError(e.into()))?
-        .ok_or(AdminError::UnexpectedError(anyhow::anyhow!(
-            "Could not find username in session."
-        )))?;
-
-    request
-        .extensions_mut()
-        .insert(AuthenticatedUser { user_id, username });
-
-    Ok(next.run(request).await)
 }
 
 #[derive(Clone)]
 pub struct AuthenticatedUser {
     pub user_id: Uuid,
     pub username: String,
+    pub role: Role,
+}
+
+impl AuthenticatedUser {
+    pub fn is_admin(&self) -> bool {
+        matches!(self.role, Role::Admin)
+    }
 }

src/routes/admin.rs

@@ -6,11 +6,17 @@ mod posts;
 mod subscribers;
 
 use crate::{
-    authentication::AuthenticatedUser,
+    authentication::{AuthenticatedUser, Role},
     routes::{AppError, error_chain_fmt},
     session_state::TypedSession,
+    templates::{HtmlTemplate, MessageTemplate},
+};
+use anyhow::Context;
+use axum::{
+    extract::Request,
+    middleware::Next,
+    response::{IntoResponse, Response},
 };
-use axum::{extract::Request, middleware::Next, response::Response};
 pub use change_password::*;
 pub use dashboard::*;
 pub use logout::*;
@@ -55,10 +61,37 @@ pub async fn require_auth(
         .ok_or(AdminError::UnexpectedError(anyhow::anyhow!(
             "Could not find username in session."
         )))?;
+    let role = session
+        .get_role()
+        .await
+        .context("Error retrieving user role in session.")?
+        .ok_or(anyhow::anyhow!("Could not find user role in session."))?;
 
-    request
+    request.extensions_mut().insert(AuthenticatedUser {
-        .extensions_mut()
+        user_id,
-        .insert(AuthenticatedUser { user_id, username });
+        username,
+        role,
+    });
 
     Ok(next.run(request).await)
 }
+
+pub async fn require_admin(
+    session: TypedSession,
+    request: Request,
+    next: Next,
+) -> Result<Response, AppError> {
+    if let Role::Admin = session
+        .get_role()
+        .await
+        .context("Error retrieving user role in session.")?
+        .ok_or(anyhow::anyhow!("Could not find user role in session."))?
+    {
+        Ok(next.run(request).await)
+    } else {
+        Ok(HtmlTemplate(MessageTemplate::error(
+            "This action requires administrator privileges.".into(),
+        ))
+        .into_response())
+    }
+}

src/routes/admin/change_password.rs

@@ -20,7 +20,9 @@ pub struct PasswordFormData {
 }
 
 pub async fn change_password(
-    Extension(AuthenticatedUser { user_id, username }): Extension<AuthenticatedUser>,
+    Extension(AuthenticatedUser {
+        user_id, username, ..
+    }): Extension<AuthenticatedUser>,
     State(AppState {
         connection_pool, ..
     }): State<AppState>,

src/routes/admin/dashboard.rs

@@ -31,7 +31,7 @@ pub async fn admin_dashboard(
     State(AppState {
         connection_pool, ..
     }): State<AppState>,
-    Extension(AuthenticatedUser { username, .. }): Extension<AuthenticatedUser>,
+    Extension(user): Extension<AuthenticatedUser>,
 ) -> Result<Response, AppError> {
     let stats = get_stats(&connection_pool).await?;
     let idempotency_key_1 = Uuid::new_v4().to_string();
@@ -46,7 +46,7 @@ pub async fn admin_dashboard(
         .context("Could not fetch total subscribers count from the database.")?;
     let max_page = get_max_page(count);
     let template = DashboardTemplate {
-        username,
+        user,
         idempotency_key_1,
         idempotency_key_2,
         stats,

src/routes/login.rs

@@ -48,7 +48,7 @@ pub async fn post_login(
         password: form.password,
     };
     tracing::Span::current().record("username", tracing::field::display(&credentials.username));
-    let user_id = validate_credentials(credentials, &connection_pool).await?;
+    let (user_id, role) = validate_credentials(credentials, &connection_pool).await?;
     tracing::Span::current().record("user_id", tracing::field::display(&user_id));
 
     session.renew().await.context("Failed to renew session.")?;
@@ -60,6 +60,10 @@ pub async fn post_login(
         .insert_username(form.username)
         .await
         .context("Failed to insert username in session data store.")?;
+    session
+        .insert_role(role)
+        .await
+        .context("Failed to insert role in session data store.")?;
 
     let mut headers = HeaderMap::new();
     headers.insert("HX-Redirect", "/admin/dashboard".parse().unwrap());

src/session_state.rs

@@ -3,6 +3,8 @@ use std::result;
 use tower_sessions::{Session, session::Error};
 use uuid::Uuid;
 
+use crate::authentication::Role;
+
 pub struct TypedSession(Session);
 
 type Result<T> = result::Result<T, Error>;
@@ -10,6 +12,7 @@ type Result<T> = result::Result<T, Error>;
 impl TypedSession {
     const USER_ID_KEY: &'static str = "user_id";
     const USERNAME_KEY: &'static str = "username";
+    const ROLE_KEY: &'static str = "role";
 
     pub async fn renew(&self) -> Result<()> {
         self.0.cycle_id().await
@@ -31,6 +34,14 @@ impl TypedSession {
         self.0.get(Self::USERNAME_KEY).await
     }
 
+    pub async fn insert_role(&self, role: Role) -> Result<()> {
+        self.0.insert(Self::ROLE_KEY, role).await
+    }
+
+    pub async fn get_role(&self) -> Result<Option<Role>> {
+        self.0.get(Self::ROLE_KEY).await
+    }
+
     pub async fn clear(&self) {
         self.0.clear().await;
     }

src/startup.rs

@@ -85,14 +85,17 @@ pub fn app(
         base_url,
     };
     let admin_routes = Router::new()
+        .route("/subscribers", get(get_subscribers_page))
+        .route("/subscribers/{subscriber_id}", delete(delete_subscriber))
+        .route("/posts/{post_id}", delete(delete_post))
+        .layer(middleware::from_fn(require_admin));
+    let auth_routes = Router::new()
         .route("/dashboard", get(admin_dashboard))
         .route("/password", post(change_password))
         .route("/newsletters", post(publish_newsletter))
         .route("/posts", post(create_post))
-        .route("/posts/{post_id}", delete(delete_post))
         .route("/logout", get(logout))
-        .route("/subscribers", get(get_subscribers_page))
+        .merge(admin_routes)
-        .route("/subscribers/{subscriber_id}", delete(delete_subscriber))
         .layer(middleware::from_fn(require_auth));
     Router::new()
         .route("/", get(home))
@@ -106,7 +109,7 @@ pub fn app(
         .route("/posts/load_more", get(load_more))
         .route("/posts/{post_id}", get(see_post))
         .route("/favicon.ico", get(favicon))
-        .nest("/admin", admin_routes)
+        .nest("/admin", auth_routes)
         .nest_service("/assets", ServeDir::new("assets"))
         .layer(
             TraceLayer::new_for_http().make_span_with(|request: &Request<_>| {

src/templates.rs

@@ -1,4 +1,5 @@
 use crate::{
+    authentication::AuthenticatedUser,
     domain::{PostEntry, SubscriberEntry},
     routes::{AppError, DashboardStats},
 };
@@ -49,7 +50,7 @@ pub struct LoginTemplate;
 #[derive(Template)]
 #[template(path = "dashboard/dashboard.html")]
 pub struct DashboardTemplate {
-    pub username: String,
+    pub user: AuthenticatedUser,
     pub idempotency_key_1: String,
     pub idempotency_key_2: String,
     pub stats: DashboardStats,

templates/dashboard/dashboard.html

@@ -1,11 +1,16 @@
 {% extends "base.html" %}
 {% block title %}Dashboard{% endblock %}
 {% block content %}
-    <div class="min-w-6/12 mx-auto p-4 sm:p-6">
+    <div class="max-w-5xl mx-auto p-4 sm:p-6">
         <div class="mb-8">
             <h1 class="text-3xl font-bold text-gray-900">Dashboard</h1>
-            <p class="mt-2 text-gray-600">
+            <p class="mt-2 text-gray-600 items-start">
-                Connected as <span class="font-bold">{{ username }}</span>
+                <span>Connected as <span class="font-bold">{{ user.username }}</span></span>
+                {% if user.is_admin() %}
+                    <span class="ml-2 inline-flex items-center rounded-full bg-blue-100 px-2.5 py-0.5 text-xs font-medium text-blue-800">
+                        admin
+                    </span>
+                {% endif %}
             </p>
             <button hx-get="/admin/logout"
                     type="submit"
@@ -16,8 +21,13 @@
                 <span>Logout</span>
             </button>
         </div>
+        {% if user.is_admin() %}
+            <div class="mb-8 p-6 bg-gradient-to-br from-blue-50 to-indigo-50 bg-blue-50 rounded-lg border border-blue-200">
+                <h2 class="text-lg font-semibold text-blue-900 mb-6">Administration</h2>
                 {% include "stats.html" %}
                 {% include "subscribers/list.html" %}
+            </div>
+        {% endif %}
         <div class="grid grid-cols-1 lg:grid-cols-2 gap-8">
             {% include "publish.html" %}
             {% include "send_email.html" %}

tests/api/helpers.rs

@@ -64,7 +64,7 @@ impl TestUser {
         .unwrap()
         .to_string();
         sqlx::query!(
-            "INSERT INTO users (user_id, username, password_hash) VALUES ($1, $2, $3)",
+            "INSERT INTO users (user_id, username, password_hash, role) VALUES ($1, $2, $3, 'admin')",
             self.user_id,
             self.username,
             password_hash