changes

server-rs/src/routes/shorten.rs

@@ -8,6 +8,7 @@ use rand::Rng;
 use serde::{Deserialize, Serialize};
 use tracing::warn;
 
+use crate::pocketbase::auth_superuser;
 use crate::state::AppState;
 
 const CODE_LEN: usize = 8;
@@ -39,6 +40,22 @@ struct PbRecord {
 
 pub async fn post_shorten(state: Arc<AppState>, Json(req): Json<ShortenRequest>) -> Response {
     let pb_url = state.pocketbase_url.trim_end_matches('/');
+
+    let token = match auth_superuser(
+        &state.http_client,
+        pb_url,
+        &state.pocketbase_admin_email,
+        &state.pocketbase_admin_password,
+    )
+    .await
+    {
+        Ok(t) => t,
+        Err(err) => {
+            warn!("PocketBase superuser auth failed: {err}");
+            return StatusCode::BAD_GATEWAY.into_response();
+        }
+    };
+
     let code = generate_code();
 
     let record = PbRecord {
@@ -51,6 +68,7 @@ pub async fn post_shorten(state: Arc<AppState>, Json(req): Json<ShortenRequest>)
         .post(format!(
             "{pb_url}/api/collections/short_urls/records"
         ))
+        .header("Authorization", format!("Bearer {token}"))
         .json(&record)
         .send()
         .await;
@@ -79,13 +97,33 @@ pub async fn post_shorten(state: Arc<AppState>, Json(req): Json<ShortenRequest>)
 pub async fn get_short_url(state: Arc<AppState>, Path(code): Path<String>) -> Response {
     let pb_url = state.pocketbase_url.trim_end_matches('/');
 
+    let token = match auth_superuser(
+        &state.http_client,
+        pb_url,
+        &state.pocketbase_admin_email,
+        &state.pocketbase_admin_password,
+    )
+    .await
+    {
+        Ok(t) => t,
+        Err(err) => {
+            warn!("PocketBase superuser auth failed: {err}");
+            return StatusCode::BAD_GATEWAY.into_response();
+        }
+    };
+
     let filter = format!("code=\"{code}\"");
     let url = format!(
         "{pb_url}/api/collections/short_urls/records?filter={}&perPage=1",
         urlencoding::encode(&filter)
     );
 
-    let res = state.http_client.get(&url).send().await;
+    let res = state
+        .http_client
+        .get(&url)
+        .header("Authorization", format!("Bearer {token}"))
+        .send()
+        .await;
 
     match res {
         Ok(resp) if resp.status().is_success() => {