Fix CSRF protection

docs/docs/controllers/pages.md

@@ -18,7 +18,7 @@ if request.get() {
 
 To avoid doing this and cluttering your codebase, Rwf comes with the [`PageController`](https://docs.rs/rwf/latest/rwf/controller/trait.PageController.html). This controller trait implements the `GET`/`POST` split automatically and routes requests to two separate methods: `async fn get` and `async fn post`.
 
-  Let's use the example of a login page and implement the `PageController` for it:
+Let's use the example of a login page built using the `PageController`:
 
 ```rust
 use rwf::prelude::*;
@@ -29,7 +29,7 @@ struct Login;
 impl PageController for Login {
     // Handle GET and show the login form.
     async fn get(&self, request: &Request) -> Result<Response, Error> {
-        render!("templates/login.html")
+        render!(request, "templates/login.html")
     }
 
     // Handle POST, receive form data, check information, and

docs/docs/views/templates/templates-in-controllers.md

@@ -26,23 +26,25 @@ Since it's very common to render templates inside controllers, Rwf has the `rend
 #[async_trait]
 impl Controller for Index {
     async fn handle(&self, request: &Request) -> Result<Response, Error> {
-        render!("templates/index.html", "title" => "Home page")
+        render!(request, "templates/index.html", "title" => "Home page")
     }
 }
 ```
 
-The `render!` macro takes the template path as the first argument, and optionally, a mapping of variable names and values as subsequent arguments. It returns a [`Response`](../../controllers/response.md) automatically.
+The `render!` macro takes the request as the first argument, the template path, and optionally a mapping of variable names and values. It returns a [`Response`](../../controllers/response.md) automatically.
 
-If the template doesn't have any variables, you can use `render!` with just the template name:
+If the template doesn't have any variables, you can omit them:
 
 ```rust
-render!("templates/index.html")
+render!(request, "templates/index.html")
 ```
 
+Passing the request into the macro ensures that secure [CSRF](../../security/CSRF.md) protection tokens are generated automatically.
+
 ### Response code
 
 By default, the `render!` macro returns the rendered template with HTTP code `200 OK`. If you want to return a different code, pass it as the last argument to the macro:
 
 ```rust
-render!("templates/index.html", "title" => "Home page", 201)
+render!(request, "templates/index.html", "title" => "Home page", 201)
 ```

docs/docs/views/templates/variables.md

@@ -79,7 +79,7 @@ async fn main() {
 You can override default variables in each template, by specifying the variable value when rendering the template:
 
 ```rust
-render!("templates/index.html", "global_var" => "Another value")
+render!(request, "templates/index.html", "global_var" => "Another value")
 ```
 
 

examples/files/src/controllers/mod.rs

@@ -6,8 +6,8 @@ pub struct Upload;
 #[async_trait]
 impl PageController for Upload {
     /// Upload page.
-    async fn get(&self, _req: &Request) -> Result<Response, Error> {
-        render!("templates/upload.html")
+    async fn get(&self, req: &Request) -> Result<Response, Error> {
+        render!(req, "templates/upload.html")
     }
 
     /// Handle upload file.
@@ -16,7 +16,7 @@ impl PageController for Upload {
         let comment = form_data.get_required::<String>("comment")?;
 
         if let Some(file) = form_data.file("file") {
-            render!("templates/ok.html",
+            render!(req, "templates/ok.html",
                 "name" => file.name(),
                 "size" => file.body().len() as i64,
                 "content_type" => file.content_type(),

examples/turbo/src/controllers/chat/mod.rs

@@ -33,8 +33,14 @@ impl Default for ChatController {
 }
 
 impl ChatController {
-    fn chat_message(user: &User, message: &ChatMessage, mine: bool) -> Result<TurboStream, Error> {
+    fn chat_message(
+        request: &Request,
+        user: &User,
+        message: &ChatMessage,
+        mine: bool,
+    ) -> Result<TurboStream, Error> {
         Ok(turbo_stream!(
+            request,
             "templates/chat_message.html",
             "messages",
             "message" => UserMessage {
@@ -73,7 +79,7 @@ impl PageController for ChatController {
             })
             .collect::<Vec<_>>();
 
-        render!("templates/chat.html",
+        render!(request, "templates/chat.html",
             "title" => "rwf + Turbo = chat",
             "messages" => messages,
             "user" => user
@@ -99,16 +105,17 @@ impl PageController for ChatController {
         // Broadcast the message to everyone else.
         {
             let broadcast = Comms::broadcast(&user);
-            let message = Self::chat_message(&user, &message, false)?.render();
+            let message = Self::chat_message(request, &user, &message, false)?.render();
 
             broadcast.send(message)?;
-            broadcast.send(TypingState { typing: false }.render(&user)?)?;
+            broadcast.send(TypingState { typing: false }.render(request, &user)?)?;
         }
 
         // Display the message for the user.
-        let chat_message = Self::chat_message(&user, &message, true)?;
+        let chat_message = Self::chat_message(request, &user, &message, true)?;
 
         let form = turbo_stream!(
+            request,
             "templates/chat_form.html",
             "form",
             "user" => user,

examples/turbo/src/controllers/chat/typing/mod.rs

@@ -15,7 +15,7 @@ impl Controller for TypingController {
 
         if let Some(user) = user {
             let broadcast = Comms::broadcast(&user);
-            broadcast.send(state.render(&user)?)?;
+            broadcast.send(state.render(request, &user)?)?;
 
             Ok(serde_json::json!({
                 "status": "success",
@@ -33,8 +33,9 @@ pub struct TypingState {
 }
 
 impl TypingState {
-    pub fn render(&self, user: &User) -> Result<TurboStream, Error> {
+    pub fn render(&self, request: &Request, user: &User) -> Result<TurboStream, Error> {
         let stream = turbo_stream!(
+            request,
             "templates/typing.html",
             "typing-indicators"
             "user" => user.clone()

examples/turbo/src/controllers/signup/mod.rs

@@ -29,8 +29,8 @@ impl Default for SignupController {
 #[async_trait]
 impl PageController for SignupController {
     /// Respond to GET request.
-    async fn get(&self, _request: &Request) -> Result<Response, Error> {
-        render!("templates/signup.html", "title" => "Signup")
+    async fn get(&self, request: &Request) -> Result<Response, Error> {
+        render!(request, "templates/signup.html", "title" => "Signup")
     }
 
     /// Respond to POST request.

rwf-admin/src/controllers/models.rs

@@ -8,9 +8,10 @@ pub struct ModelsController;
 
 #[async_trait]
 impl Controller for ModelsController {
-    async fn handle(&self, _request: &Request) -> Result<Response, Error> {
+    async fn handle(&self, request: &Request) -> Result<Response, Error> {
         let tables = Table::load().await?;
-        render!("templates/rwf_admin/models.html",
+        render!(request,
+            "templates/rwf_admin/models.html",
             "title" => "Models | Rust Web Framework",
             "models" => tables
         )
@@ -85,7 +86,8 @@ impl PageController for ModelController {
                     data.push(row.values()?);
                 }
 
-                render!("templates/rwf_admin/model.html",
+                render!(request,
+                    "templates/rwf_admin/model.html",
                     "title" => format!("{} | Rust Web Framework", model),
                     "table_name" => model,
                     "columns" => columns,
@@ -114,7 +116,7 @@ impl PageController for NewModelController {
             .filter(|c| !c.skip())
             .collect::<Vec<_>>();
 
-        render!("templates/rwf_admin/model_new.html",
+        render!(request, "templates/rwf_admin/model_new.html",
             "title" => format!("New record | {} | Rust Web Framework", model),
             "table_name" => model,
             "columns" => columns,

rwf-admin/src/controllers/requests.rs

@@ -6,7 +6,7 @@ pub struct Requests;
 
 #[async_trait]
 impl Controller for Requests {
-    async fn handle(&self, _request: &Request) -> Result<Response, Error> {
+    async fn handle(&self, request: &Request) -> Result<Response, Error> {
         let requests = {
             let mut conn = Pool::connection().await?;
             RequestByCode::count(60).fetch_all(&mut conn).await?
@@ -20,7 +20,7 @@ impl Controller for Requests {
         let requests = serde_json::to_string(&requests)?;
         let duration = serde_json::to_string(&duration)?;
 
-        render!("templates/rwf_admin/requests.html",
+        render!(request, "templates/rwf_admin/requests.html",
             "title" => "Requests | Rust Web Framework",
             "requests" => requests,
             "duration" => duration,

rwf-macros/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rwf-macros"
-version = "0.1.11"
+version = "0.1.12"
 edition = "2021"
 license = "MIT"
 description = "Macros for the Rust Web Framework"

rwf-macros/src/lib.rs

@@ -606,7 +606,7 @@ pub fn context(input: TokenStream) -> TokenStream {
 /// ### Example
 ///
 /// ```ignore
-/// render!("templates/index.html", "title" => "Home page")
+/// render!(request, "templates/index.html", "title" => "Home page")
 /// ```
 #[proc_macro]
 pub fn render(input: TokenStream) -> TokenStream {

rwf-macros/src/render.rs

@@ -1,13 +1,17 @@
 use crate::prelude::*;
 
 struct RenderInput {
+    request: Expr,
+    _comma_0: Token![,],
     template_name: LitStr,
-    _comma: Option<Token![,]>,
+    _comma_1: Option<Token![,]>,
     context: Vec<ContextInput>,
     code: Option<LitInt>,
 }
 
 struct TurboStreamInput {
+    request: Expr,
+    _comma_0: Token![,],
     template_name: LitStr,
     _comma_1: Token![,],
     id: Expr,
@@ -18,8 +22,10 @@ struct TurboStreamInput {
 impl TurboStreamInput {
     fn render_input(&self) -> RenderInput {
         RenderInput {
+            request: self.request.clone(),
+            _comma_0: self._comma_0.clone(),
             template_name: self.template_name.clone(),
-            _comma: self._comma_2.clone(),
+            _comma_1: self._comma_2.clone(),
             context: self.context.clone(),
             code: None,
         }
@@ -28,6 +34,8 @@ impl TurboStreamInput {
 
 impl Parse for TurboStreamInput {
     fn parse(input: ParseStream) -> Result<Self> {
+        let request: Expr = input.parse()?;
+        let _comma_0: Token![,] = input.parse()?;
         let template_name: LitStr = input.parse()?;
         let _comma_1: Token![,] = input.parse()?;
         let id: Expr = input.parse()?;
@@ -43,6 +51,8 @@ impl Parse for TurboStreamInput {
         }
 
         Ok(TurboStreamInput {
+            request,
+            _comma_0,
             template_name,
             _comma_1,
             id,
@@ -61,11 +71,15 @@ struct ContextInput {
 }
 
 struct Context {
+    // request: Expr,
+    // _comma_0: Token![,],
     values: Vec<ContextInput>,
 }
 
 impl Parse for Context {
     fn parse(input: ParseStream) -> Result<Self> {
+        // let request: Expr = input.parse()?;
+        // let _comma_0: Token![,] = input.parse()?;
         let mut values = vec![];
         loop {
             let context: Result<ContextInput> = input.parse();
@@ -77,7 +91,11 @@ impl Parse for Context {
             }
         }
 
-        Ok(Context { values })
+        Ok(Context {
+            // request,
+            // _comma_0,
+            values,
+        })
     }
 }
 
@@ -94,11 +112,13 @@ impl Parse for ContextInput {
 
 impl Parse for RenderInput {
     fn parse(input: ParseStream) -> Result<Self> {
+        let request: Expr = input.parse()?;
+        let _comma_0: Token![,] = input.parse()?;
         let template_name: LitStr = input.parse()?;
-        let _comma: Option<Token![,]> = input.parse()?;
+        let _comma_1: Option<Token![,]> = input.parse()?;
         let mut code = None;
 
-        let context = if _comma.is_some() {
+        let context = if _comma_1.is_some() {
             let mut result = vec![];
             loop {
                 if input.peek(LitInt) {
@@ -121,22 +141,26 @@ impl Parse for RenderInput {
         };
 
         Ok(RenderInput {
+            request,
+            _comma_0,
             template_name,
-            _comma,
+            _comma_1,
             context,
             code,
         })
     }
 }
 
 fn render_call(input: &RenderInput) -> proc_macro2::TokenStream {
+    let request = &input.request;
     let render_call = if input.context.is_empty() {
         vec![quote! {
-            let html = template.render_default()?;
+            let context = rwf::view::template::Context::from_request(#request)?;
+            let html = template.render(&context)?;
         }]
     } else {
         let mut values = vec![quote! {
-            let mut context = rwf::view::template::Context::new();
+            let mut context = rwf::view::template::Context::from_request(#request)?;
         }];
 
         for value in &input.context {

rwf/Cargo.toml

@@ -32,7 +32,7 @@ parking_lot = "0.12"
 once_cell = "1"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
-rwf-macros = { path = "../rwf-macros", version = "0.1.11" }
+rwf-macros = { path = "../rwf-macros", version = "0.1.12" }
 colored = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"