Netflix Backend Rust

This project is the backend for a Netflix clone built with Rust, using Actix-web for the web server and MongoDB for the database. It handles user authentication, movie listings, user profiles, and more.

Features

• User authentication (login and registration)
• Passwords hashed with Argon2id and a per-user random salt — stored as PHC strings, never recoverable, not even by this service
• CRUD operations for movies and lists
• User profile management
• Secure handling of JWTs for session management

A note on password storage

An earlier version of this backend encrypted passwords with AES-256-CBC and decrypted them to compare at login. That is the wrong primitive: encryption is reversible, so anyone holding SECRET_KEY and a copy of the database could recover every password in plaintext, and the comparison itself was not constant-time.

Passwords are now hashed with Argon2id. Hashing is one-way by design — there is no inverse function in this codebase, the signing key is no longer involved in credential storage, and verification runs in constant time.

Upgrading an existing database: rows written by the old scheme hold AES ciphertext rather than a PHC string, so they will not verify. Those users need a password reset; there is no migration path, which is the point of a one-way hash.

Prerequisites

Before you begin, ensure you have met the following requirements:

• Rust 1.80 or higher
• Docker and Docker Compose
• MongoDB account and database

Getting Started

These instructions will get you a copy of the project up and running on your local machine for development and testing purposes.

Environment Setup

1. Clone the repository:

   git clone https://github.com/abdulwaarith0/netflix_backend_rust.git
   cd netflix_backend_rust

2. Set up your .env file based on the .env.example provided in the repository. Make sure to replace the placeholders with your actual MongoDB URL and secret key.

Running with Docker

To run the application using Docker, follow these steps:

1. Build the Docker images:

   make build

2. Start the application:

   make up

3. To stop the application:

   make down

4. For a complete cleanup (removing all containers, networks, and volumes):

   make clean

Running Locally without Docker

If you prefer to run the application without Docker:

1. Install MongoDB locally or set up a remote MongoDB instance.
2. Install the required Rust dependencies:

   cargo build

3. Run the application:

   cargo run

API Endpoints

Below are the available RESTful endpoints grouped by resource.

Authentication

Method	Endpoint	Description	Requires Auth
POST	/api/auth/login	Logs in a user	No
POST	/api/auth/register	Registers a new user	No

Movies

Method	Endpoint	Description	Requires Auth
GET	/api/movies	Retrieves all movies	Yes
POST	/api/movies	Adds a new movie	Yes
GET	/api/movies/{id}	Retrieves a movie by ID	Yes
GET	/api/movies/random	Retrieves a random movie	No

Users

Method	Endpoint	Description	Requires Auth
GET	/api/users	Fetches all users	Yes
GET	/api/users/{id}	Fetches a specific user	Yes

Health Check

Method	Endpoint	Description	Requires Auth
GET	/api/health	Checks service health	No