401 响应没有 x-frame-options：层的顺序反了

tower = { version = "=0.5.3", features = ["util"] }
tokio = { version = "=1.54.1", features = ["full"] }
axum = "=0.8.9"

use axum::body::Body;
use axum::extract::Request;
use axum::http::{HeaderValue, StatusCode};
use axum::middleware::{from_fn, Next};
use axum::response::{IntoResponse, Response};
use axum::routing::get;
use axum::Router;
use tower::util::MapResponseLayer;
use tower::{ServiceBuilder, ServiceExt};

// Rejects every request without a `token` header.
async fn require_token(req: Request, next: Next) -> Response {
  if req.headers().contains_key("token") {
    next.run(req).await
  } else {
    StatusCode::UNAUTHORIZED.into_response()
  }
}

fn add_header(mut res: Response) -> Response {
  res.headers_mut().insert("x-frame-options", HeaderValue::from_static("DENY"));
  res
}

async fn show(name: &str, app: Router) {
  let req = Request::get("/").body(Body::empty()).unwrap();
  let res = app.oneshot(req).await.unwrap();
  println!(
    "{name}: {} x-frame-options={:?}",
    res.status(),
    res.headers().get("x-frame-options")
  );
}

#[tokio::main(flavor = "current_thread")]
async fn main() {
  // Written "header first, auth second", as one would with ServiceBuilder.
  let app = Router::new()
    .route("/", get(|| async { "ok" }))
    .layer(MapResponseLayer::new(add_header))
    .layer(from_fn(require_token));
  show("Router::layer, header first", app).await;

  let app = Router::new()
    .route("/", get(|| async { "ok" }))
    .layer(from_fn(require_token))
    .layer(MapResponseLayer::new(add_header));
  show("Router::layer, header last ", app).await;

  let app = Router::new().route("/", get(|| async { "ok" })).layer(
    ServiceBuilder::new()
      .layer(MapResponseLayer::new(add_header))
      .layer(from_fn(require_token)),
  );
  show("ServiceBuilder, header first", app).await;
}

Router::layer, header first: 401 Unauthorized x-frame-options=None
Router::layer, header last : 401 Unauthorized x-frame-options=Some("DENY")
ServiceBuilder, header first: 401 Unauthorized x-frame-options=Some("DENY")

use std::future::Future;
use std::pin::Pin;
use std::task::{Context, Poll};

use axum::body::Body;
use axum::http::Request;
use axum::routing::get;
use axum::Router;
use tower::{Layer, Service, ServiceBuilder, ServiceExt};

#[derive(Clone)]
struct LogLayer(&'static str);

#[derive(Clone)]
struct Log<S> {
  name: &'static str,
  inner: S,
}

impl<S> Layer<S> for LogLayer {
  type Service = Log<S>;
  fn layer(&self, inner: S) -> Log<S> {
    Log { name: self.0, inner }
  }
}

impl<S, R> Service<R> for Log<S>
where
  S: Service<R>,
  S::Future: Send + 'static,
{
  type Response = S::Response;
  type Error = S::Error;
  type Future = Pin<Box<dyn Future<Output = Result<S::Response, S::Error>> + Send>>;

  fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), S::Error>> {
    self.inner.poll_ready(cx)
  }

  fn call(&mut self, req: R) -> Self::Future {
    println!("  {} sees request", self.name);
    let name = self.name;
    let fut = self.inner.call(req);
    Box::pin(async move {
      let res = fut.await;
      println!("  {} sees response", name);
      res
    })
  }
}

async fn handler() -> &'static str {
  println!("  handler");
  "ok"
}

fn req() -> Request<Body> {
  Request::get("/").body(Body::empty()).unwrap()
}

#[tokio::main(flavor = "current_thread")]
async fn main() {
  println!("ServiceBuilder::new().layer(A).layer(B).service(..)");
  let svc = ServiceBuilder::new()
    .layer(LogLayer("A"))
    .layer(LogLayer("B"))
    .service(Router::new().route("/", get(handler)));
  svc.oneshot(req()).await.unwrap();

  println!("Router::new().route(..).layer(A).layer(B)");
  let app = Router::new()
    .route("/", get(handler))
    .layer(LogLayer("A"))
    .layer(LogLayer("B"));
  app.oneshot(req()).await.unwrap();

  println!("Router::new().route(..).layer(ServiceBuilder::new().layer(A).layer(B))");
  let app = Router::new()
    .route("/", get(handler))
    .layer(ServiceBuilder::new().layer(LogLayer("A")).layer(LogLayer("B")));
  app.oneshot(req()).await.unwrap();
}

ServiceBuilder::new().layer(A).layer(B).service(..)
  A sees request
  B sees request
  handler
  B sees response
  A sees response
Router::new().route(..).layer(A).layer(B)
  B sees request
  A sees request
  handler
  A sees response
  B sees response
Router::new().route(..).layer(ServiceBuilder::new().layer(A).layer(B))
  A sees request
  B sees request
  handler
  B sees response
  A sees response

    pub(crate) fn layer<L, NewError>(self, layer: L) -> Route<NewError>
    where
        // ...
    {
        let layer = (MapErrLayer::new(Into::into), layer);

        Route::new(layer.layer(self))
    }