Backend (Rust / Axum)

A module backend is an Axum service (Rust 2021) backed by PostgreSQL through SQLx. A few hard rules guarantee quality and security.

The bootstrap (main.rs) #

// 1. Charger la config (variables KC__… ou config.toml)
// 2. Créer le pool PgPool et lancer les migrations (schéma du module)
// 3. Construire le routeur Axum
// 4. S'enregistrer auprès du core (/internal/modules/…) avec X-Internal-Secret
// 5. Boucler le heartbeat ; se désenregistrer à l'arrêt

Quality rules #

  • Zero unwrap() outside tests — use ?, or expect() in the bootstrap only.
  • Every DB error is logged (tracing::error!) before returning; validate inputs before any DB operation.
  • Atomic transactions for multi-table writes.
  • <module> schema only — no tables outside your schema.
  • cargo clippy -- -D warnings must pass.

Authentication handed over by the core #

The module does not validate JWTs itself. The core authenticates the request, then proxies it while injecting the identity into headers — your middleware only has to check the internal secret and read the user:

X-Internal-Secret : <secret partagé>     # remplace l'Authorization
X-Kubuno-User-Id  : <uuid>
X-Kubuno-User-Role: user | admin
X-Kubuno-User-Email: <email>

Route security #

  • Never put passwords or refresh tokens in logs or JSON.
  • Public routes: no information leaks (don't distinguish "unknown email" from "wrong password").
  • /internal/* rejects any request without a valid X-Internal-Secret.