Routing & HTTP

Routing lives in routes/web.rs and is backed by axum with typed extractors. The router DSL supports get, post, put, delete, patch, options, and any, plus route groups with prefix and naming.

Scope

Route introspection

cargo artisan route:list renders the live 6-column route table published by the application at boot:

route:list --json emits the same metadata for tooling and agents. openapi:generate derives an OpenAPI 3.1 spec from the same table.

Declarative attributes

Proc-macro attributes keep cross-cutting concerns next to the handler:

#[middleware(auth)]
#[authorize(PostPolicy::update)]
async fn update(State(state): State<AppState>, Path(id): Path<i64>) -> Json<Post> { /* ... */ }

#[middleware] resolves through the router's MiddlewareRegistry and #[authorize] through the AuthorizeRegistry; both are applied during dispatch.

Rate limiting and CORS

• Rate limiting uses a fluent limiter — limit.perMinute().by(ip) — mapped onto a Throttle layer.
• CORS is configured through config/cors.toml (rustasea_http::CorsConfig), restrictive by default.

HTTP client

The reqwest wrapper implements Laravel-style callbacks and a typed HttpError, and enforces an idle (inter-chunk) timeout for streamed bodies.

let response = Http::get("https://api.example.com/users")
    .throw()
    .send()
    .await?;