max / makenotwork

1.2 KB · 32 lines History Blame Raw

1	//! HTML page routes, split by domain.
2
3	mod blog;
4	pub(crate) mod dashboard;
5	mod email_actions;
6	mod feeds;
7	pub(crate) mod public;
8	mod sandbox;
9
10	use crate::{AppState, csrf::CsrfRouter};
11	use axum::Router;
12
13	/// Compose the page tree from posture-declared sub-groups and `finalize()` once.
14	///
15	/// Every sub-router is a `CsrfRouter`, and `CsrfRouter::merge` only accepts
16	/// another `CsrfRouter`, so a bare `axum::Router` (which can carry an
17	/// undeclared mutation route) is a type error here, not a silent CSRF bypass.
18	/// This is the structural resolution of the Run #16/#17 CHRONIC: the old code
19	/// merged `email_actions`/`sandbox`/`feeds`/`blog` as bare `Router`s, and
20	/// `email_actions`'s `POST /forgot-password` (plus `sandbox`'s `POST /sandbox`)
21	/// skipped the envelope. `finalize()` drops the wrapper exactly once, here.
22	pub fn page_routes(limits: crate::constants::RateLimits) -> Router<AppState> {
23	CsrfRouter::new()
24	.merge(public::public_routes(limits))
25	.merge(sandbox::sandbox_routes(limits))
26	.merge(dashboard::dashboard_routes())
27	.merge(email_actions::email_action_routes(limits))
28	.merge(feeds::feed_routes())
29	.merge(blog::blog_routes())
30	.finalize()
31	}
32