Error with middleware error handler

[dwuertz]

I've implemented an HandleErrorLayer that catches errors my auth middleware can throw. I'm getting a compile error which I don't really understand. Any clues here?

use axum::{
    error_handling::HandleErrorLayer,
    Router,
    http::StatusCode,
    middleware::{self, Next},
    response::{IntoResponse, Response},
    routing::get,
};
use std::net::SocketAddr;
use http;
use tower::builder::ServiceBuilder;

#[derive(Debug)]
enum AuthError {
    UNAUTHORIZED
}

impl IntoResponse for AuthError {
    fn into_response(self) -> Response {
        (StatusCode::UNAUTHORIZED, "You shall not pass").into_response()
    }
}

async fn auth<B>(req: http::Request<B>, next: Next<B>) -> Result<Response, AuthError> {
    // Snip auth check
    Ok(next.run(req).await)
}

async fn handle_auth_error(err: AuthError) -> (StatusCode, String) {
    (
        StatusCode::INTERNAL_SERVER_ERROR,
        format!("Something went wrong: {:?}", err),
    )
}

#[tokio::main]
async fn main() {
    let app = Router::new()
        .route("/", get(|| async { "Hello" }))
        .layer(ServiceBuilder::new()
            .layer(HandleErrorLayer::new(handle_auth_error))
            .layer(middleware::from_fn(auth))
        );

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));

    axum::Server::bind(&addr)
        .serve(app.into_make_service())
        .await
        .unwrap();
}

error[E0277]: the trait bound `HandleError<axum::middleware::FromFn<fn(Request<_>, Next<_>) -> impl Future<Output = Result<Response<http_body::combinators::box_body::UnsyncBoxBody<axum::body::Bytes, axum::Error>>, AuthError>> {auth::<_>}, Route<_>>, fn(AuthError) -> impl Future<Output = (StatusCode, String)> {handle_auth_error}, _>: Service<Request<_>>` is not satisfied
   --> src/main.rs:40:10
    |
40  |         .layer(ServiceBuilder::new()
    |          ^^^^^ the trait `Service<Request<_>>` is not implemented for `HandleError<axum::middleware::FromFn<fn(Request<_>, Next<_>) -> impl Future<Output = Result<Response<http_body::combinators::box_body::UnsyncBoxBody<axum::body::Bytes, axum::Error>>, AuthError>> {auth::<_>}, Route<_>>, fn(AuthError) -> impl Future<Output = (StatusCode, String)> {handle_auth_error}, _>`
    |
    = help: the following other types implement trait `Service<Request>`:
              HandleError<S, F, ()>
              HandleError<S, F, (T1, T2)>
              HandleError<S, F, (T1, T2, T3)>
              HandleError<S, F, (T1, T2, T3, T4)>
              HandleError<S, F, (T1, T2, T3, T4, T5)>
              HandleError<S, F, (T1, T2, T3, T4, T5, T6)>
              HandleError<S, F, (T1, T2, T3, T4, T5, T6, T7)>
              HandleError<S, F, (T1, T2, T3, T4, T5, T6, T7, T8)>
            and 9 others
note: required by a bound in `Router::<B>::layer`
   --> /home/dude/.cargo/registry/src/github.com-1ecc6299db9ec823/axum-0.5.13/src/routing/mod.rs:297:21
    |
297 |         L::Service: Service<Request<NewReqBody>, Response = Response<NewResBody>, Error = Infallible>
    |                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ required by this bound in `Router::<B>::layer`

[davidpdrsn]

You're misunderstanding what HandleErrorLayer is for and how axum's error handling works. Please read https://docs.rs/axum/latest/axum/error_handling/ and specifically pay attention to the fact that returning something like "unauthorized" is not and error. That's just a response like any other.

I don't really understand what you're trying to do. Why do you need to handle an error that your own middleware returns? Can't you just handle it directly in the auth middleware itself?

[dwuertz]

Thanks a lot for the quick reply!

You're misunderstanding what HandleErrorLayer is for and how axum's error handling works. Please read https://docs.rs/axum/latest/axum/error_handling/ and specifically pay attention to the fact that returning something like "unauthorized" is not and error. That's just a response like any other.

Thanks for the pointer, seems I didn't read carefully enough. I guess you are refering to this section?

While it looks like it might fail with a StatusCode this actually isn’t an “error”. If this handler returns Err(some_status_code) that will still be converted into a Response and sent back to the client. This is done through StatusCode’s IntoResponse implementation.

So after reading again, I thought that my impl IntoResponse for AuthError would be the culprit and removed it. Unfortunately, it didn't help. So now I'm still puzzled what my AuthError type is missing to actually be treated as an error. Apologies if I'm missing anything obvious. New code:

use axum::{
    error_handling::HandleErrorLayer,
    Router,
    http::StatusCode,
    middleware::{self, Next},
    response::Response,
    routing::get,
};
use std::net::SocketAddr;
use http;
use tower::builder::ServiceBuilder;

#[derive(Debug)]
enum AuthError {
    UNAUTHORIZED
}

async fn auth<B>(req: http::Request<B>, next: Next<B>) -> Result<Response, AuthError> {
    Err(AuthError::UNAUTHORIZED)
}

async fn handle_auth_error(err: AuthError) -> (StatusCode, String) {
    (
        StatusCode::INTERNAL_SERVER_ERROR,
        format!("Something went wrong: {:?}", err),
    )
}

#[tokio::main]
async fn main() {
    let app = Router::new()
        .route("/", get(|| async { "Hello" }))
        .layer(ServiceBuilder::new()
            .layer(HandleErrorLayer::new(handle_auth_error))
            .layer(middleware::from_fn(auth))
        );

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));

    axum::Server::bind(&addr)
        .serve(app.into_make_service())
        .await
        .unwrap();
}

I don't really understand what you're trying to do. Why do you need to handle an error that your own middleware returns? Can't you just handle it directly in the auth middleware itself?

The idea is that by splitting the error handling from the auth process I can produce different error responses for different routes (e.g. redirect to login form for web pages, JSON for APIs). Could be that there exists a better approach, not sure.

[davidpdrsn]

So after reading again, I thought that my impl IntoResponse for AuthError would be the culprit and removed it. Unfortunately, it didn't help. So now I'm still puzzled what my AuthError type is missing to actually be treated as an error.

It can't be treated as an error. Middleware created with from_fn always must return a response, never an error. Remember that returning "unauthorized" (or any other status) is not an error.

The idea is that by splitting the error handling from the auth process I can produce different error responses for different routes (e.g. redirect to login form for web pages, JSON for APIs). Could be that there exists a better approach, not sure.

You're already doing that by implementing IntoResponse for AuthError. Its response representation will be returned if that's what you return from the middleware. You can make AuthError return a JSON response the same way you would a response from a handler.

[dwuertz]

It can't be treated as an error. Middleware created with from_fn always must return a response, never an error. Remember that returning "unauthorized" (or any other status) is not an error.

So to be able to return an error, I need to implement the middleware via impl Layer and impl Service? Can/should I use type Error = AuthError here as the associated error type for my Service impl?

You're already doing that by implementing IntoResponse for AuthError. Its response representation will be returned if that's what you return from the middleware. You can make AuthError return a JSON response the same way you would a response from a handler.

Yeah, but I can only have a single impl IntoResponse for AuthError, not multiple possible responses within the same app (for different routes), right?

[davidpdrsn]

So to be able to return an error, I need to implement the middleware via impl Layer and impl Service? Can/should I use type Error = AuthError here as the associated error type for my Service impl?

Yes but I still don't understand why you want to do this. You're making things harder for yourself. Just return AuthError and implement IntoResponse for that.

Yeah, but I can only have a single impl IntoResponse for AuthError, not multiple possible responses within the same app (for different routes), right?

Correct but you can make other error types if you want, implement IntoResponse for those and return them from other middleware or handlers. You're not liked locked in to a single error type or something like that.