Module routes 

The HTTP surface. Handlers stay thin: access rules live in auth, package lookups in store.

Structs

AppState

MotdQuery

PackagesQuery

Functions

caller 🔒

The caller’s credential: None for anonymous, malformed and unknown keys alike, Err when the lookup itself failed, which each caller handles.

content_disposition 🔒

Names the LEAF, since a whole name contains /: an ASCII filename that cannot close its quotes, and the exact name as RFC 6266 filename*.

download 🔒

The status never reveals what a protected directory holds: an impossible key is 404, a protected directory without a live key is 401 whether or not the package exists, and a missing grant answers the same 404 as a missing package. Public packages never touch the auth database, so a database outage cannot take the free catalogue down.

health 🔒

if_none_match 🔒

Whether If-None-Match names this ETag, in a list, as a weak validator (which matches for a GET) or as *.

list_packages 🔒

Never 4xx: an unusable credential silently gets the anonymous listing, so probing cannot reveal directory names, and so does a failed credential lookup, since the public catalogue is still right.

motd 🔒

No auth; 404 when there is no text at all, which the installer treats as being offline.

report_conflict 🔒

POST /report/conflict: no auth, since users without a key hit conflicts too.

router

Serve it with into_make_service_with_connect_info::<SocketAddr>(), since the report limiter needs the peer address.

whoami 🔒

GET /whoami: 200 with shared::KeyStatus for a live key, 401 for every other, which is how a client tells a mistyped key from a good one.

Type Aliases

SharedState 🔒