max / makenotwork

1.3 KB · 35 lines History Blame Raw

1	//! HTML page routes, split by domain.
2
3	mod blog;
4	pub(crate) mod dashboard;
5	mod email_actions;
6	mod feeds;
7	pub(crate) mod public;
8	mod sandbox;
9
10	use crate::{AppState, csrf::CsrfRouter};
11	use axum::Router;
12
13	/// Compose the page tree from posture-declared sub-groups and `finalize()` once.
14	///
15	/// Every sub-router is a `CsrfRouter`, and `CsrfRouter::merge` only accepts
16	/// another `CsrfRouter`, so a bare `axum::Router` (which can carry an
17	/// undeclared mutation route) is a type error here, not a silent CSRF bypass.
18	/// This is the structural resolution of the Run #16/#17 CHRONIC: the old code
19	/// merged `email_actions`/`sandbox`/`feeds`/`blog` as bare `Router`s, and
20	/// `email_actions`'s `POST /forgot-password` (plus `sandbox`'s `POST /sandbox`)
21	/// skipped the envelope. `finalize()` drops the wrapper exactly once, here.
22	pub fn page_routes(
23	limits: crate::constants::RateLimits,
24	screens: &crate::config::QuasiScreens,
25	) -> Router<AppState> {
26	CsrfRouter::new()
27	.merge(public::public_routes(limits, screens))
28	.merge(sandbox::sandbox_routes(limits))
29	.merge(dashboard::dashboard_routes(screens))
30	.merge(email_actions::email_action_routes(limits))
31	.merge(feeds::feed_routes())
32	.merge(blog::blog_routes())
33	.finalize()
34	}
35