Protected Routes

In Rapina, all routes are protected by default. The #[public] attribute is an opt-out — without it, the framework requires a valid JWT token in the Authorization header.

To access information about the authenticated user, use the CurrentUser extractor:

async fn handler(user: CurrentUser) -> Json<T> {
    // user.id, user.name, user.email are available
}

If no valid token is provided, Rapina automatically returns a 401 Unauthorized response before your handler ever runs.

Assignment

1. Remove the #[public] attribute to make the route protected
2. Add CurrentUser as a parameter to the handler
3. Use user.name to return a personalized greeting like "Hello, Alice!"

use rapina::prelude::*;

#[derive(Serialize, JsonSchema)]
struct ProfileResponse {
    message: String,
}

#[get("/profile")]
async fn profile(user: CurrentUser) -> Json<ProfileResponse> {
    Json(ProfileResponse {
        message: format!("Hello, {}!", user.name),
    })
}