clawmates/crates/cm-api/src/routes/auth.rs

use axum::extract::{Request, State};
use axum::http::StatusCode;
use axum::Json;
use serde::Deserialize;
use serde_json::{json, Value};

use crate::extract::bearer_secret;
use crate::{ApiError, AppState};

#[derive(Deserialize)]
pub struct LoginRequest {
    email: String,
    password: String,
}

pub async fn login(
    State(state): State<AppState>,
    Json(body): Json<LoginRequest>,
) -> Result<Json<Value>, ApiError> {
    let token = state.auth.login_local(&body.email, &body.password).await?;
    Ok(Json(json!({ "token": token.secret() })))
}

/// Revokes the presented token. No prior authentication step: deleting by
/// token hash can only ever revoke the session of the token the caller
/// already holds, and revoking an expired session must still succeed.
pub async fn logout(State(state): State<AppState>, req: Request) -> Result<StatusCode, ApiError> {
    let (parts, _) = req.into_parts();
    let secret = bearer_secret(&parts)?;
    state.auth.logout(secret).await?;
    Ok(StatusCode::NO_CONTENT)
}