portal/src/auth.rs

use leptos::prelude::*;
use serde::{Deserialize, Serialize};

/// The authenticated user, as established by the Kanidm OIDC flow and
/// stored in the server-side session. Ported from cnats' `auth.rs` -
/// same shape, same provider.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct User {
    pub sub: String,
    pub username: String,
    pub display_name: String,
    /// Kanidm group membership, from the `groups` OIDC claim (see
    /// `oauth2 update-claim-map`). Fixed at login time - not re-checked
    /// live, so a group change only takes effect on the next login.
    #[serde(default)]
    pub groups: Vec<String>,
    /// The phone number the provider verified (`phone_number`, from
    /// userinfo), when it gives one: what a membership is keyed by first.
    #[serde(default)]
    pub phone: Option<String>,
    /// The address Kanidm holds for them (the `email` claim), so a page
    /// can know it is talking to the person it names as responsible.
    #[serde(default)]
    pub email: Option<String>,
}

pub const SESSION_USER_KEY: &str = "user";

/// Returns the currently signed-in user, if any.
#[server(endpoint = "current_user")]
pub async fn current_user() -> Result<Option<User>, ServerFnError> {
    let session: tower_sessions::Session = leptos_axum::extract().await?;
    let user = session
        .get::<User>(SESSION_USER_KEY)
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    Ok(user)
}