Proper user authentication

src/main.rs

@@ -8,25 +8,38 @@ use dotenvy::dotenv;
 use sqlx::postgres::PgPool;
 use tokio::net::TcpListener;
 use tower_http::cors::CorsLayer;
+use tower_sessions::cookie::SameSite;
+use tower_sessions::{SessionManagerLayer};
+use tower_sessions_sqlx_store::PostgresStore;
+use tower_sessions_sqlx_store::sqlx::PgPool as SessionPgPool;
 
+mod error;
 mod users;
-use users::{login, me};
+use users::{login, me, logout};
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn Error>> {
     dotenv()?;
     let db_url = var("DATABASE_URL")?;
     let pool = PgPool::connect(&db_url).await?;
+    let session_pool = SessionPgPool::connect(&db_url).await?;
+    let session_store = PostgresStore::new(session_pool);
+    session_store.migrate().await?;
+    let session = SessionManagerLayer::new(session_store)
+        .with_secure(false)
+        .with_same_site(SameSite::Lax);
     let app = Router::new()
         .route("/status", get(status))
         .route("/me", get(me))
         .route("/login", get(login))
+        .route("/logout", get(logout))
         .layer(
             CorsLayer::new()
                 .allow_origin("http://localhost:5173".parse::<HeaderValue>().unwrap())
                 .allow_methods([Method::GET])
                 .allow_credentials(true),
         )
+        .layer(session)
         .with_state(pool);
     let listener = TcpListener::bind("0.0.0.0:8080").await?;
     Ok(serve(listener, app).await?)