cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

perf: round 4 — one-pass row paths, drive-selector cache, CalDAV single-parse, streamed Azure, batched hydration

Browse Source 
Nine benchmark-gated changes (benches/ROUND4.md; every one ships with a
BEFORE/AFTER bench + equivalence gate, rollback rule as ROUND2/3):

- Row→entity path build: one-pass StoragePath::from_folder_and_name /
  from_joined + normalize_storage_name_owned + alloc-free Display —
  743→417 ns/file-row (1.78x), −5 allocs/row on every listing surface.
- WebDAV drive-selector: per-user readable_cache (single-flight, 30 s
  TTL, explicit invalidation incl. membership + group changes) replaces
  the grants join per request — 441 µs → 0.8 µs (~550x), 0 queries warm.
- CalDAV from_ical/update_ical_data: 8 full IcalParser runs per VEVENT
  → 1 (7.1x per PUT, 4.4x on 50-event imports); alloc-free split_vevents,
  chunk scan without the whole-body uppercase copy (1.4x), borrowed-key
  UID grouping (1.3x), REPORT props no longer cloned.
- PROPFIND emit: partition Vecs dropped (single-pass 404 list) + stack
  rendered RFC 3339/2822 dates, sizes, quoted etags (common::fmt,
  chrono-byte-identical, sweep-tested) on both DAV surfaces — 1.22x
  per page, 17.9→12.0 allocs/row.
- Grant-listing hydration: calendars/address books/playlists batch
  hydrate via = ANY($1) — 15 serial queries → 1 (~13x per sync poll).
- user-flags cache: get→insert → try_get_with single-flight (32→1
  queries per cold herd).
- Azure downloads: whole-blob Vec buffering → streamed SDK pages —
  TTFB 349→4 ms (87x), peak heap 480→1.9 MiB (254x) on 256 MiB blobs;
  new OXICLOUD_AZURE_ENDPOINT_URL override (Azurite/bench hook).
- Face indexing: unbounded per-image tokio::spawn → core-count
  semaphore, permit before blob read — peak heap 1175→176 MiB (6.7x).

Checks: cargo fmt, clippy --all-features --all-targets -D warnings,
cargo test --workspace (523 passed) + --features test_utils. hurl API
suite and dockerized integration DB not runnable in this environment —
left to CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017aJu9ghvuT8WqC31ZEGTBA
This commit is contained in:
Claude
2026-07-17 13:48:37 +00:00
parent 8a73607229
commit 12dc648cff
44 changed files with 5092 additions and 402 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/application/adapters/caldav_adapter.rs
+66 -20
View File
@@ -56,14 +56,32 @@ fn parse_caldav_datetime(value: &str) -> Option<DateTime<Utc>> {
/// `None` if either tag is missing (malformed body) so callers
/// can fall back safely.
pub(crate) fn extract_vevent_chunk(ical_data: &str) -> Option<&str> {
let upper = ical_data.to_ascii_uppercase();
let begin = upper.find("BEGIN:VEVENT")?;
// End marker: the line-start of END:VEVENT after `begin`, plus
// the length of "END:VEVENT" itself, then find the next CRLF/LF
// to include the terminator line.
let after_begin = &upper[begin..];
let rel_end = after_begin.find("END:VEVENT")?;
let end_tag_end = begin + rel_end + "END:VEVENT".len();
// Byte index of the first ASCII-case-insensitive occurrence of
// `needle` in `hay` at or after `from`. Every stored body OxiCloud
// itself writes carries uppercase tags, so try the memchr-backed
// exact `find` first; only genuinely mixed-case foreign bodies pay
// the manual scan. Either way this replaces the old
// `to_ascii_uppercase()` of the ENTIRE body — one full-copy String
// allocation per event per REPORT/GET, done purely to locate two
// tags.
fn find_ci(hay: &str, needle: &str, from: usize) -> Option<usize> {
if let Some(i) = hay[from..].find(needle) {
return Some(from + i);
}
let h = hay.as_bytes();
let n = needle.as_bytes();
if h.len() < n.len() {
return None;
}
(from..=h.len() - n.len()).find(|&i| h[i..i + n.len()].eq_ignore_ascii_case(n))
}
let begin = find_ci(ical_data, "BEGIN:VEVENT", 0)?;
// End marker: the first END:VEVENT after `begin`, plus the length
// of "END:VEVENT" itself, then any immediate CRLF/LF to include
// the terminator line.
let rel_end = find_ci(ical_data, "END:VEVENT", begin)?;
let end_tag_end = rel_end + "END:VEVENT".len();
// Include any immediate line terminator so the chunk stays a
// well-formed line even when the caller concatenates.
let mut end = end_tag_end;
@@ -88,21 +106,27 @@ pub(crate) fn extract_vevent_chunk(ical_data: &str) -> Option<&str> {
pub(crate) fn group_events_by_uid<'a>(
events: &'a [CalendarEventDto],
) -> Vec<Vec<&'a CalendarEventDto>> {
let mut order: Vec<String> = Vec::new();
let mut buckets: std::collections::HashMap<String, Vec<&'a CalendarEventDto>> =
// Keys borrow from the DTO slice (which outlives every local) — the
// old String-keyed map cloned every event's UID (twice for first
// appearances) on every REPORT / collection PROPFIND / GET.
let mut order: Vec<&'a str> = Vec::new();
let mut buckets: std::collections::HashMap<&'a str, Vec<&'a CalendarEventDto>> =
std::collections::HashMap::new();
for event in events {
let key = event.ical_uid.clone();
if !buckets.contains_key(&key) {
order.push(key.clone());
let key = event.ical_uid.as_str();
match buckets.entry(key) {
std::collections::hash_map::Entry::Vacant(slot) => {
order.push(key);
slot.insert(vec![event]);
}
std::collections::hash_map::Entry::Occupied(mut slot) => slot.get_mut().push(event),
}
buckets.entry(key).or_default().push(event);
}
let mut out = Vec::with_capacity(order.len());
for uid in order {
let mut bucket = buckets.remove(&uid).unwrap_or_default();
let mut bucket = buckets.remove(uid).unwrap_or_default();
// Master first (recurrence_id None), exceptions in insertion order.
bucket.sort_by_key(|e| e.recurrence_id.is_some());
out.push(bucket);
@@ -1123,11 +1147,13 @@ impl CalDavAdapter {
]),
))?;
// Determine which properties to include based on request type
// Determine which properties to include based on request type —
// borrowed straight out of the request (the old `clone()` copied
// the whole Vec of owned QualifiedName strings per REPORT).
let props = match request {
CalDavReportType::CalendarQuery { props, .. } => props.clone(),
CalDavReportType::CalendarMultiget { props, .. } => props.clone(),
CalDavReportType::SyncCollection { props, .. } => props.clone(),
CalDavReportType::CalendarQuery { props, .. } => props,
CalDavReportType::CalendarMultiget { props, .. } => props,
CalDavReportType::SyncCollection { props, .. } => props,
};
// Add responses for events — folded per UID so a
@@ -1143,7 +1169,7 @@ impl CalDavAdapter {
None => continue,
};
let href = format!("{}{}.ics", base_href, anchor.ical_uid);
Self::write_event_response(&mut xml_writer, &bundle, &props, &href)?;
Self::write_event_response(&mut xml_writer, &bundle, props, &href)?;
}
// End multistatus
@@ -1418,6 +1444,26 @@ impl CalDavAdapter {
}
}
// ─────────────────────────────────────────────────────────────
// Bench support
// ─────────────────────────────────────────────────────────────
/// Thin public wrappers over the `pub(crate)` read-side helpers so
/// `examples/bench_caldav_parse.rs` can measure them. Gated behind the
/// `bench` feature — adds nothing to prod builds.
#[cfg(feature = "bench")]
pub mod bench {
use super::*;
pub fn extract_vevent_chunk(ical_data: &str) -> Option<&str> {
super::extract_vevent_chunk(ical_data)
}
pub fn group_events_by_uid(events: &[CalendarEventDto]) -> Vec<Vec<&CalendarEventDto>> {
super::group_events_by_uid(events)
}
}
// ─────────────────────────────────────────────────────────────
// Tests
// ─────────────────────────────────────────────────────────────
src/application/adapters/webdav_adapter.rs
+147 -120
View File
@@ -627,17 +627,19 @@ impl WebDavAdapter {
// RFC 4918 §9.2: known props → 200 propstat; unknown → 404 propstat.
// Props found in the dead store are returned in the dead 200 propstat,
// so exclude them from the 404 propstat to avoid duplicate reporting.
let (known, unknown): (Vec<_>, Vec<_>) = props
// Single pass: the requested-props writer skips unknown
// names itself (its match arms mirror
// `folder_prop_is_known` exactly), so only the usually
// empty 404 list needs materialising — the old
// `partition` built two throwaway Vecs per row.
let truly_unknown: Vec<_> = props
.iter()
.partition(|p| Self::folder_prop_is_known(p, quota));
let truly_unknown: Vec<_> = unknown
.into_iter()
.filter(|p| !dead_name_set.contains(*p))
.filter(|p| !Self::folder_prop_is_known(p, quota) && !dead_name_set.contains(p))
.collect();
xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
Self::write_folder_requested_props(xml_writer, folder, &known, quota)?;
Self::write_folder_requested_props(xml_writer, folder, props, quota)?;
xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
@@ -714,16 +716,19 @@ impl WebDavAdapter {
// RFC 4918 §9.2: known props → 200 propstat; unknown → 404 propstat.
// Props found in the dead store are returned in the dead 200 propstat,
// so exclude them from the 404 propstat to avoid duplicate reporting.
let (known, unknown): (Vec<_>, Vec<_>) =
props.iter().partition(|p| Self::file_prop_is_known(p));
let truly_unknown: Vec<_> = unknown
.into_iter()
.filter(|p| !dead_name_set.contains(*p))
// Single pass: the requested-props writer skips unknown
// names itself (its match arms mirror `file_prop_is_known`
// exactly), so only the usually empty 404 list needs
// materialising — the old `partition` built two throwaway
// Vecs per row.
let truly_unknown: Vec<_> = props
.iter()
.filter(|p| !Self::file_prop_is_known(p) && !dead_name_set.contains(p))
.collect();
xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
Self::write_file_requested_props(xml_writer, file, &known)?;
Self::write_file_requested_props(xml_writer, file, props)?;
xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
@@ -759,6 +764,71 @@ impl WebDavAdapter {
Ok(())
}
// ── Per-row formatted-value writers (stack-rendered) ─────────────
//
// PROPFIND emits two formatted dates, a size and a quoted etag for
// EVERY row of every listing. `to_rfc3339()`/`to_rfc2822()` ran
// chrono's format-spec interpreter and allocated a String each;
// `to_string()`/`format!` added two more. These render the same
// bytes from stack buffers (`common::fmt`); out-of-range timestamps
// keep the old chrono path as a byte-identical fallback.
fn write_creationdate<W: Write>(xml_writer: &mut Writer<W>, secs: u64) -> Result<()> {
xml_writer.write_event(Event::Start(BytesStart::new("D:creationdate")))?;
let secs = secs as i64;
let mut buf = [0u8; 25];
match crate::common::fmt::rfc3339_utc(&mut buf, secs) {
Some(s) => xml_writer.write_event(Event::Text(BytesText::new(s)))?,
None => {
let s = chrono::DateTime::<Utc>::from_timestamp(secs, 0)
.unwrap_or_else(Utc::now)
.to_rfc3339();
xml_writer.write_event(Event::Text(BytesText::new(&s)))?;
}
}
xml_writer.write_event(Event::End(BytesEnd::new("D:creationdate")))?;
Ok(())
}
fn write_lastmodified<W: Write>(xml_writer: &mut Writer<W>, secs: u64) -> Result<()> {
xml_writer.write_event(Event::Start(BytesStart::new("D:getlastmodified")))?;
let secs = secs as i64;
let mut buf = [0u8; 31];
match crate::common::fmt::rfc2822_utc(&mut buf, secs) {
Some(s) => xml_writer.write_event(Event::Text(BytesText::new(s)))?,
None => {
let s = chrono::DateTime::<Utc>::from_timestamp(secs, 0)
.unwrap_or_else(Utc::now)
.to_rfc2822();
xml_writer.write_event(Event::Text(BytesText::new(&s)))?;
}
}
xml_writer.write_event(Event::End(BytesEnd::new("D:getlastmodified")))?;
Ok(())
}
fn write_etag_quoted<W: Write>(xml_writer: &mut Writer<W>, etag: &str) -> Result<()> {
xml_writer.write_event(Event::Start(BytesStart::new("D:getetag")))?;
// One exactly-sized allocation instead of format!'s grow-from-empty.
let mut quoted = String::with_capacity(etag.len() + 2);
quoted.push('"');
quoted.push_str(etag);
quoted.push('"');
xml_writer.write_event(Event::Text(BytesText::new(&quoted)))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getetag")))?;
Ok(())
}
fn write_contentlength<W: Write>(xml_writer: &mut Writer<W>, size: u64) -> Result<()> {
xml_writer.write_event(Event::Start(BytesStart::new("D:getcontentlength")))?;
let mut buf = [0u8; 20];
xml_writer.write_event(Event::Text(BytesText::new(crate::common::fmt::u64_str(
&mut buf, size,
))))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getcontentlength")))?;
Ok(())
}
/// Write standard folder properties
fn write_folder_standard_props<W: Write>(
xml_writer: &mut Writer<W>,
@@ -776,31 +846,15 @@ impl WebDavAdapter {
xml_writer.write_event(Event::End(BytesEnd::new("D:displayname")))?;
// Creation date
xml_writer.write_event(Event::Start(BytesStart::new("D:creationdate")))?;
// Convert u64 timestamp to DateTime
let created_at = chrono::DateTime::<Utc>::from_timestamp(folder.created_at as i64, 0)
.unwrap_or_else(Utc::now);
xml_writer.write_event(Event::Text(BytesText::new(&created_at.to_rfc3339())))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:creationdate")))?;
Self::write_creationdate(xml_writer, folder.created_at)?;
// Last modified
xml_writer.write_event(Event::Start(BytesStart::new("D:getlastmodified")))?;
// Convert u64 timestamp to DateTime
let modified_at = chrono::DateTime::<Utc>::from_timestamp(folder.modified_at as i64, 0)
.unwrap_or_else(Utc::now);
xml_writer.write_event(Event::Text(BytesText::new(&modified_at.to_rfc2822())))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getlastmodified")))?;
Self::write_lastmodified(xml_writer, folder.modified_at)?;
// ETag — routes through `FolderDto::etag` (= `Folder::etag()`)
// so every WebDAV emitter and HEAD response agree on a single
// value for the same folder.
xml_writer.write_event(Event::Start(BytesStart::new("D:getetag")))?;
xml_writer.write_event(Event::Text(BytesText::new(&format!("\"{}\"", folder.etag))))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getetag")))?;
Self::write_etag_quoted(xml_writer, &folder.etag)?;
// Content length (0 for directories)
xml_writer.write_event(Event::Start(BytesStart::new("D:getcontentlength")))?;
@@ -829,13 +883,19 @@ impl WebDavAdapter {
used_bytes: i64,
available_bytes: Option<i64>,
) -> Result<()> {
let mut buf = [0u8; 21];
xml_writer.write_event(Event::Start(BytesStart::new("D:quota-used-bytes")))?;
xml_writer.write_event(Event::Text(BytesText::new(&used_bytes.to_string())))?;
xml_writer.write_event(Event::Text(BytesText::new(crate::common::fmt::i64_str(
&mut buf, used_bytes,
))))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:quota-used-bytes")))?;
if let Some(available_bytes) = available_bytes {
xml_writer.write_event(Event::Start(BytesStart::new("D:quota-available-bytes")))?;
xml_writer.write_event(Event::Text(BytesText::new(&available_bytes.to_string())))?;
xml_writer.write_event(Event::Text(BytesText::new(crate::common::fmt::i64_str(
&mut buf,
available_bytes,
))))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:quota-available-bytes")))?;
}
@@ -861,36 +921,18 @@ impl WebDavAdapter {
xml_writer.write_event(Event::End(BytesEnd::new("D:getcontenttype")))?;
// Content length
xml_writer.write_event(Event::Start(BytesStart::new("D:getcontentlength")))?;
xml_writer.write_event(Event::Text(BytesText::new(&file.size.to_string())))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getcontentlength")))?;
Self::write_contentlength(xml_writer, file.size)?;
// Creation date
xml_writer.write_event(Event::Start(BytesStart::new("D:creationdate")))?;
// Convert u64 timestamp to DateTime
let created_at = chrono::DateTime::<Utc>::from_timestamp(file.created_at as i64, 0)
.unwrap_or_else(Utc::now);
xml_writer.write_event(Event::Text(BytesText::new(&created_at.to_rfc3339())))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:creationdate")))?;
Self::write_creationdate(xml_writer, file.created_at)?;
// Last modified
xml_writer.write_event(Event::Start(BytesStart::new("D:getlastmodified")))?;
// Convert u64 timestamp to DateTime
let modified_at = chrono::DateTime::<Utc>::from_timestamp(file.modified_at as i64, 0)
.unwrap_or_else(Utc::now);
xml_writer.write_event(Event::Text(BytesText::new(&modified_at.to_rfc2822())))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getlastmodified")))?;
Self::write_lastmodified(xml_writer, file.modified_at)?;
// ETag — routes through `FileDto::etag` (= `File::etag()`) so
// PROPFIND, GET, HEAD, PUT-response, and MOVE all emit
// byte-identical values for the same file.
xml_writer.write_event(Event::Start(BytesStart::new("D:getetag")))?;
xml_writer.write_event(Event::Text(BytesText::new(&format!("\"{}\"", file.etag))))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getetag")))?;
Self::write_etag_quoted(xml_writer, &file.etag)?;
Ok(())
}
@@ -936,7 +978,7 @@ impl WebDavAdapter {
fn write_folder_requested_props<W: Write>(
xml_writer: &mut Writer<W>,
folder: &FolderDto,
props: &[&QualifiedName],
props: &[QualifiedName],
quota: Option<(i64, Option<i64>)>,
) -> Result<()> {
for prop in props {
@@ -953,37 +995,13 @@ impl WebDavAdapter {
xml_writer.write_event(Event::End(BytesEnd::new("D:displayname")))?;
}
"creationdate" => {
xml_writer.write_event(Event::Start(BytesStart::new("D:creationdate")))?;
// Convert u64 timestamp to DateTime
let created_at =
chrono::DateTime::<Utc>::from_timestamp(folder.created_at as i64, 0)
.unwrap_or_else(Utc::now);
xml_writer
.write_event(Event::Text(BytesText::new(&created_at.to_rfc3339())))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:creationdate")))?;
Self::write_creationdate(xml_writer, folder.created_at)?;
}
"getlastmodified" => {
xml_writer
.write_event(Event::Start(BytesStart::new("D:getlastmodified")))?;
// Convert u64 timestamp to DateTime
let modified_at =
chrono::DateTime::<Utc>::from_timestamp(folder.modified_at as i64, 0)
.unwrap_or_else(Utc::now);
xml_writer
.write_event(Event::Text(BytesText::new(&modified_at.to_rfc2822())))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getlastmodified")))?;
Self::write_lastmodified(xml_writer, folder.modified_at)?;
}
"getetag" => {
xml_writer.write_event(Event::Start(BytesStart::new("D:getetag")))?;
xml_writer.write_event(Event::Text(BytesText::new(&format!(
"\"{}\"",
folder.etag
))))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getetag")))?;
Self::write_etag_quoted(xml_writer, &folder.etag)?;
}
"getcontentlength" => {
xml_writer
@@ -1000,21 +1018,25 @@ impl WebDavAdapter {
}
"quota-used-bytes" => {
if let Some((used, _)) = quota {
let mut buf = [0u8; 21];
xml_writer
.write_event(Event::Start(BytesStart::new("D:quota-used-bytes")))?;
xml_writer
.write_event(Event::Text(BytesText::new(&used.to_string())))?;
xml_writer.write_event(Event::Text(BytesText::new(
crate::common::fmt::i64_str(&mut buf, used),
)))?;
xml_writer
.write_event(Event::End(BytesEnd::new("D:quota-used-bytes")))?;
}
}
"quota-available-bytes" => {
if let Some((_, Some(available))) = quota {
let mut buf = [0u8; 21];
xml_writer.write_event(Event::Start(BytesStart::new(
"D:quota-available-bytes",
)))?;
xml_writer
.write_event(Event::Text(BytesText::new(&available.to_string())))?;
xml_writer.write_event(Event::Text(BytesText::new(
crate::common::fmt::i64_str(&mut buf, available),
)))?;
xml_writer.write_event(Event::End(BytesEnd::new(
"D:quota-available-bytes",
)))?;
@@ -1035,7 +1057,7 @@ impl WebDavAdapter {
fn write_file_requested_props<W: Write>(
xml_writer: &mut Writer<W>,
file: &FileDto,
props: &[&QualifiedName],
props: &[QualifiedName],
) -> Result<()> {
for prop in props {
if prop.namespace == "DAV:" {
@@ -1055,44 +1077,16 @@ impl WebDavAdapter {
xml_writer.write_event(Event::End(BytesEnd::new("D:getcontenttype")))?;
}
"getcontentlength" => {
xml_writer
.write_event(Event::Start(BytesStart::new("D:getcontentlength")))?;
xml_writer
.write_event(Event::Text(BytesText::new(&file.size.to_string())))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getcontentlength")))?;
Self::write_contentlength(xml_writer, file.size)?;
}
"creationdate" => {
xml_writer.write_event(Event::Start(BytesStart::new("D:creationdate")))?;
// Convert u64 timestamp to DateTime
let created_at =
chrono::DateTime::<Utc>::from_timestamp(file.created_at as i64, 0)
.unwrap_or_else(Utc::now);
xml_writer
.write_event(Event::Text(BytesText::new(&created_at.to_rfc3339())))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:creationdate")))?;
Self::write_creationdate(xml_writer, file.created_at)?;
}
"getlastmodified" => {
xml_writer
.write_event(Event::Start(BytesStart::new("D:getlastmodified")))?;
// Convert u64 timestamp to DateTime
let modified_at =
chrono::DateTime::<Utc>::from_timestamp(file.modified_at as i64, 0)
.unwrap_or_else(Utc::now);
xml_writer
.write_event(Event::Text(BytesText::new(&modified_at.to_rfc2822())))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getlastmodified")))?;
Self::write_lastmodified(xml_writer, file.modified_at)?;
}
"getetag" => {
xml_writer.write_event(Event::Start(BytesStart::new("D:getetag")))?;
xml_writer.write_event(Event::Text(BytesText::new(&format!(
"\"{}\"",
file.etag
))))?;
xml_writer.write_event(Event::End(BytesEnd::new("D:getetag")))?;
Self::write_etag_quoted(xml_writer, &file.etag)?;
}
_ => {
// Unknown prop — skipped here; caller writes 404 propstat.
@@ -1586,3 +1580,36 @@ impl WebDavAdapter {
Self::write_file_response_with_dead_props(writer, file, request, href, dead_props)
}
}
/// Thin public wrappers over the private per-row PROPFIND writers so
/// `examples/bench_propfind_xml.rs` can measure them. Gated behind the
/// `bench` feature — adds nothing to prod builds.
#[cfg(feature = "bench")]
pub mod bench {
use super::*;
pub fn write_file_propfind_row<W: Write>(
xml_writer: &mut Writer<W>,
file: &FileDto,
request: &PropFindRequest,
href: &str,
dead_props: &[(QualifiedName, Option<String>)],
) -> Result<()> {
WebDavAdapter::write_file_response_with_dead_props(
xml_writer, file, request, href, dead_props,
)
}
pub fn write_folder_propfind_row<W: Write>(
xml_writer: &mut Writer<W>,
folder: &FolderDto,
request: &PropFindRequest,
href: &str,
dead_props: &[(QualifiedName, Option<String>)],
quota: Option<(i64, Option<i64>)>,
) -> Result<()> {
WebDavAdapter::write_folder_response_with_dead_props(
xml_writer, folder, request, href, dead_props, quota,
)
}
}
src/application/ports/calendar_ports.rs
+6
View File
@@ -34,6 +34,12 @@ pub trait CalendarStoragePort: Send + Sync + 'static {
) -> Result<CalendarDto, DomainError>;
async fn delete_calendar(&self, calendar_id: &str) -> Result<(), DomainError>;
async fn get_calendar(&self, calendar_id: &str) -> Result<CalendarDto, DomainError>;
/// Batch sibling of [`Self::get_calendar`]: hydrate a page of
/// grant-derived calendar ids in ONE storage round-trip. Missing
/// rows (deleted/trashed race) drop out silently; ordering is not
/// guaranteed.
async fn get_calendars_by_ids(&self, ids: &[Uuid]) -> Result<Vec<CalendarDto>, DomainError>;
async fn list_calendars_by_owner(
&self,
owner_id: Uuid,
src/application/ports/carddav_ports.rs
+6
View File
@@ -37,6 +37,12 @@ pub trait ContactStoragePort: Send + Sync + 'static {
) -> Result<AddressBook, DomainError>;
async fn delete_address_book(&self, id: &Uuid) -> Result<(), DomainError>;
async fn get_address_book_by_id(&self, id: &Uuid) -> Result<Option<AddressBook>, DomainError>;
/// Batch sibling of [`Self::get_address_book_by_id`]: hydrate a page
/// of grant-derived ids in ONE storage round-trip. Missing rows drop
/// out silently; ordering is not guaranteed.
async fn get_address_books_by_ids(&self, ids: &[Uuid])
-> Result<Vec<AddressBook>, DomainError>;
async fn get_public_address_books(&self) -> Result<Vec<AddressBook>, DomainError>;
// ── Contacts ─────────────────────────────────────────────────
src/application/ports/music_ports.rs
+5
View File
@@ -104,6 +104,11 @@ pub trait MusicStoragePort: Send + Sync {
async fn get_playlist(&self, playlist_id: &str) -> Result<Option<PlaylistDto>, DomainError>;
/// Batch sibling of [`Self::get_playlist`]: hydrate a page of
/// grant-derived ids in ONE storage round-trip. Missing rows drop
/// out silently; ordering is not guaranteed.
async fn get_playlists_by_ids(&self, ids: &[Uuid]) -> Result<Vec<PlaylistDto>, DomainError>;
async fn list_playlists_by_owner(
&self,
owner_id: Uuid,
src/application/services/auth_application_service.rs
+24 -12
View File
@@ -147,8 +147,12 @@ pub struct AuthApplicationService {
/// request. The short TTL keeps the "role changes apply without token
/// rotation" property within seconds while removing one DB round-trip
/// per request; the known mutation paths (`change_user_role`,
/// `set_user_active`) also invalidate eagerly.
user_flags_cache: Cache<Uuid, UserFlags>,
/// `set_user_active`) also invalidate eagerly. `moka::future` so
/// concurrent misses for one user coalesce into a single DB lookup
/// (`try_get_with` single-flight) — every authenticated request
/// calls this, so each 30 s TTL expiry used to fan out one SELECT
/// per in-flight request of that user.
user_flags_cache: moka::future::Cache<Uuid, UserFlags>,
/// Self-service auth-method allowlist (mirrors
/// `AuthConfig::allowed_auth_methods`). Empty = both methods
/// allowed. Consulted by login / register / magic-link handlers via
@@ -198,7 +202,7 @@ impl AuthApplicationService {
.time_to_live(Duration::from_secs(120))
.build(),
magic_link_repo: None,
user_flags_cache: Cache::builder()
user_flags_cache: moka::future::Cache::builder()
.max_capacity(10_000)
.time_to_live(USER_FLAGS_CACHE_TTL)
.build(),
@@ -1363,7 +1367,7 @@ impl AuthApplicationService {
// Invalidate the flags cache so subsequent per-request guards
// observe the new `is_external=false` without waiting for the
// 30-second TTL. Same pattern as `change_user_role`.
self.user_flags_cache.invalidate(&caller_id);
self.user_flags_cache.invalidate(&caller_id).await;
// Dispatch — home-drive provisioning happens here. Log-and-
// continue: a provisioning failure leaves the row updated and
@@ -1508,12 +1512,20 @@ impl AuthApplicationService {
/// Staleness is bounded by [`USER_FLAGS_CACHE_TTL`]; role and active
/// changes made through this service invalidate the entry eagerly.
pub async fn get_user_flags(&self, user_id: Uuid) -> Result<UserFlags, DomainError> {
if let Some(flags) = self.user_flags_cache.get(&user_id) {
return Ok(flags);
}
let flags = self.user_storage.get_user_flags(user_id).await?;
self.user_flags_cache.insert(user_id, flags);
Ok(flags)
// Single-flight: concurrent misses for the same user coalesce
// into ONE storage lookup; errors are never cached (same herd
// shape ROUND3 fixed for basic-auth, minus the Argon2 cost).
self.user_flags_cache
.try_get_with(user_id, async {
Ok::<_, DomainError>(self.user_storage.get_user_flags(user_id).await?)
})
.await
// try_get_with hands back `Arc<DomainError>` shared by all
// waiters; DomainError isn't Clone, so rebuild a fresh one
// preserving the kind / entity / message.
.map_err(|shared: std::sync::Arc<DomainError>| {
DomainError::new(shared.kind, shared.entity_type, shared.message.clone())
})
}
/// Apply a profile update on behalf of the calling user (PR 24).
@@ -2226,7 +2238,7 @@ impl AuthApplicationService {
self.user_storage
.set_user_active_status(user_id, active)
.await?;
self.user_flags_cache.invalidate(&user_id);
self.user_flags_cache.invalidate(&user_id).await;
Ok(())
}
@@ -2240,7 +2252,7 @@ impl AuthApplicationService {
));
}
self.user_storage.change_role(user_id, role).await?;
self.user_flags_cache.invalidate(&user_id);
self.user_flags_cache.invalidate(&user_id).await;
Ok(())
}
src/application/services/calendar_service.rs
+7 -11
View File
@@ -189,17 +189,13 @@ impl CalendarUseCase for CalendarService {
})
.collect();
// Hydrate DTOs. `get_calendar` misses on trashed / deleted
// calendars — those are dropped from the listing rather than
// erroring, so a lifecycle-race doesn't turn a PROPFIND into
// a 5xx.
let mut out = Vec::with_capacity(calendar_ids.len());
for id in calendar_ids {
if let Ok(dto) = self.calendar_storage.get_calendar(&id.to_string()).await {
out.push(dto);
}
}
Ok(out)
// Hydrate DTOs in ONE `= ANY` round-trip (was one point SELECT
// per accessible calendar — K serial round-trips on every
// CalDAV discovery poll). Missing rows (deleted/trashed race)
// drop out of the result set instead of erroring, so a
// lifecycle-race still doesn't turn a PROPFIND into a 5xx.
let ids: Vec<Uuid> = calendar_ids.into_iter().collect();
self.calendar_storage.get_calendars_by_ids(&ids).await
}
async fn list_public_calendars(
src/application/services/contact_service.rs
+8 -6
View File
@@ -494,12 +494,14 @@ impl AddressBookUseCase for ContactService {
let mut address_book_map = std::collections::HashMap::new();
for id in book_ids {
// Missing rows (deleted / trashed race) drop out silently
// — matches the calendar-listing carve-out.
if let Ok(Some(book)) = self.contact_storage.get_address_book_by_id(&id).await {
address_book_map.insert(*book.id(), book);
}
// Hydrate in ONE `= ANY` round-trip (was one point SELECT per
// accessible book — K serial round-trips on every CardDAV
// discovery poll). Missing rows (deleted / trashed race) drop
// out of the result set — matches the calendar-listing
// carve-out.
let ids: Vec<Uuid> = book_ids.into_iter().collect();
for book in self.contact_storage.get_address_books_by_ids(&ids).await? {
address_book_map.insert(*book.id(), book);
}
// Public address books surface for every authenticated caller
src/application/services/drive_management_service.rs
+12
View File
@@ -263,6 +263,12 @@ impl DriveManagementService {
self.authz
.invalidate_drive_role_cache_for_drive(drive_id)
.await;
// Same freshness contract for the repo's readable-drives cache:
// the subject's drive list changed with this grant.
match subject {
Subject::User(uid) => self.drive_repo.invalidate_readable_for_user(uid).await,
_ => self.drive_repo.invalidate_readable_all(),
}
// D6 §11: canonical `drive.member_added` audit event covers
// every successful membership write (add + role-refresh, since
@@ -335,6 +341,12 @@ impl DriveManagementService {
self.authz
.invalidate_drive_role_cache_for_drive(drive_id)
.await;
// And the repo's readable-drives cache: the drive must vanish
// from the removed subject's list immediately.
match subject {
Subject::User(uid) => self.drive_repo.invalidate_readable_for_user(uid).await,
_ => self.drive_repo.invalidate_readable_all(),
}
// D6 §11: canonical `drive.member_removed` audit event covers
// every successful removal (owner-driven or admin bypass).
src/application/services/music_service.rs
+11 -8
View File
@@ -196,15 +196,18 @@ impl MusicUseCase for MusicService {
// only. Owner is a grant like any other in `role_grants`, so we
// filter the aggregated set against the owner_id stamped on
// each row after hydration — cheaper than a second SQL round-trip.
let mut playlists: Vec<PlaylistDto> = Vec::with_capacity(playlist_ids.len());
// Hydrate in ONE `= ANY` round-trip (was one point SELECT per
// accessible playlist). Missing rows (deleted race) drop out of
// the result set silently, as before.
let user_str = user_id.to_string();
for id in playlist_ids.drain() {
if let Ok(Some(p)) = self.storage.get_playlist(&id.to_string()).await
&& (include_shared || p.owner_id == user_str)
{
playlists.push(p);
}
}
let ids: Vec<Uuid> = playlist_ids.drain().collect();
let mut playlists: Vec<PlaylistDto> = self
.storage
.get_playlists_by_ids(&ids)
.await?
.into_iter()
.filter(|p| include_shared || p.owner_id == user_str)
.collect();
if include_public {
let public = self.storage.list_public_playlists(limit, offset).await?;
src/application/services/subject_group_service.rs
+12 -1
View File
@@ -44,6 +44,11 @@ pub struct SubjectGroupService {
/// 30 s TTL. Without this, fresh group-mediated drive grants
/// don't appear in `/api/drives` for up to 30 s after `add_member`.
engine: Arc<crate::infrastructure::services::pg_acl_engine::PgAclEngine>,
/// Same freshness contract for the drive repository's per-user
/// readable-drives cache: a membership change on a group that holds
/// drive grants changes every affected user's visible drive list,
/// so the cached lists drop alongside `user_groups_cache`.
drive_repo: Arc<crate::infrastructure::repositories::pg::DrivePgRepository>,
}
impl SubjectGroupService {
@@ -52,12 +57,14 @@ impl SubjectGroupService {
pool: Arc<PgPool>,
user_storage: Arc<UserPgRepository>,
engine: Arc<crate::infrastructure::services::pg_acl_engine::PgAclEngine>,
drive_repo: Arc<crate::infrastructure::repositories::pg::DrivePgRepository>,
) -> Self {
Self {
repo,
pool,
user_storage,
engine,
drive_repo,
}
}
@@ -426,6 +433,7 @@ impl SubjectGroupService {
// call for up to 30 s.
for uid in self.invalidation_targets(member).await? {
self.engine.invalidate_user_groups_cache(uid).await;
self.drive_repo.invalidate_readable_for_user(uid).await;
}
tracing::info!(
@@ -525,6 +533,7 @@ impl SubjectGroupService {
// for up to 30 s, surfacing grants they no longer have.
for uid in self.invalidation_targets(member).await? {
self.engine.invalidate_user_groups_cache(uid).await;
self.drive_repo.invalidate_readable_for_user(uid).await;
}
tracing::info!(
@@ -634,7 +643,9 @@ mod integration_tests {
// future test starts exercising real authz lookups.
let engine =
Arc::new(crate::infrastructure::services::pg_acl_engine::PgAclEngine::new_stub());
SubjectGroupService::new(repo, pool, user_storage, engine)
let drive_repo =
Arc::new(crate::infrastructure::repositories::pg::DrivePgRepository::new(pool.clone()));
SubjectGroupService::new(repo, pool, user_storage, engine, drive_repo)
}
async fn first_admin(pool: &sqlx::PgPool) -> Uuid {
src/common/config.rs
+5
View File
@@ -310,6 +310,10 @@ pub struct AzureStorageConfig {
pub container: String,
/// Optional SAS token (alternative to account key).
pub sas_token: Option<String>,
/// Optional custom endpoint (Azurite emulator, private deployments,
/// benches). `None` = the public cloud URL derived from the account
/// name. Mirrors S3's `endpoint_url`.
pub endpoint_url: Option<String>,
}
/// LRU local disk cache configuration for remote blob backends.
@@ -2140,6 +2144,7 @@ impl AppConfig {
account_key: env::var("OXICLOUD_AZURE_ACCOUNT_KEY").unwrap_or_default(),
container,
sas_token: env::var("OXICLOUD_AZURE_SAS_TOKEN").ok(),
endpoint_url: env::var("OXICLOUD_AZURE_ENDPOINT_URL").ok(),
});
}
src/common/di.rs
+1
View File
@@ -1682,6 +1682,7 @@ impl AppServiceFactory {
),
),
authorization.clone(),
drive_repo.clone(),
),
)),
email_sender: None, // populated below
src/common/fmt.rs
+256
View File
@@ -0,0 +1,256 @@
//! Heap-free fixed-layout formatters for the hot XML/HTTP emit paths.
//!
//! PROPFIND writes two formatted dates, a size and a quoted etag for
//! EVERY row of every listing; `to_rfc3339()` / `to_rfc2822()` run
//! chrono's format-spec interpreter and allocate a `String` each, and
//! `u64::to_string()` allocates another. These helpers render the same
//! bytes into a caller-provided stack buffer: zero heap traffic, no
//! interpreter.
//!
//! Byte-identity with chrono (for whole-second in-range UTC datetimes)
//! is asserted by the unit tests below and by the equivalence gate in
//! `examples/bench_propfind_xml.rs`. Out-of-range seconds (negative or
//! year > 9999, where the fixed-width layout no longer applies) return
//! `None` — callers keep the old chrono path as fallback, so exotic
//! values change nothing observable.
/// Seconds range rendering to a fixed-width 4-digit year: 1970-01-01
/// through 9999-12-31 23:59:59 UTC.
const MAX_4DIGIT_YEAR_SECS: i64 = 253_402_300_799;
const MONTHS: [&[u8; 3]; 12] = [
b"Jan", b"Feb", b"Mar", b"Apr", b"May", b"Jun", b"Jul", b"Aug", b"Sep", b"Oct", b"Nov", b"Dec",
];
const WEEKDAYS: [&[u8; 3]; 7] = [b"Thu", b"Fri", b"Sat", b"Sun", b"Mon", b"Tue", b"Wed"];
/// Civil date from days since 1970-01-01 (Howard Hinnant's algorithm).
fn civil_from_days(z: i64) -> (i64, u32, u32) {
let z = z + 719_468;
let era = z.div_euclid(146_097);
let doe = z.rem_euclid(146_097); // day-of-era [0, 146096]
let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365; // [0, 399]
let y = yoe + era * 400;
let doy = doe - (365 * yoe + yoe / 4 - yoe / 100); // [0, 365]
let mp = (5 * doy + 2) / 153; // [0, 11]
let d = (doy - (153 * mp + 2) / 5 + 1) as u32; // [1, 31]
let m = if mp < 10 { mp + 3 } else { mp - 9 } as u32; // [1, 12]
(if m <= 2 { y + 1 } else { y }, m, d)
}
#[inline]
fn push2(out: &mut [u8], pos: usize, v: u32) {
out[pos] = b'0' + (v / 10) as u8;
out[pos + 1] = b'0' + (v % 10) as u8;
}
#[inline]
fn push4(out: &mut [u8], pos: usize, v: i64) {
out[pos] = b'0' + (v / 1000 % 10) as u8;
out[pos + 1] = b'0' + (v / 100 % 10) as u8;
out[pos + 2] = b'0' + (v / 10 % 10) as u8;
out[pos + 3] = b'0' + (v % 10) as u8;
}
/// Split epoch seconds into (days, y, m, d, hh, mm, ss).
#[inline]
fn split(secs: i64) -> (i64, i64, u32, u32, u32, u32, u32) {
let days = secs.div_euclid(86_400);
let sod = secs.rem_euclid(86_400);
let (y, m, d) = civil_from_days(days);
(
days,
y,
m,
d,
(sod / 3600) as u32,
(sod / 60 % 60) as u32,
(sod % 60) as u32,
)
}
/// `chrono::DateTime<Utc>::to_rfc3339()` for a whole-second timestamp:
/// `2026-07-17T11:47:14+00:00` (25 bytes) written into `buf`.
///
/// Returns `None` when `secs` is outside the fixed-width range —
/// callers fall back to chrono.
pub fn rfc3339_utc(buf: &mut [u8; 25], secs: i64) -> Option<&str> {
if !(0..=MAX_4DIGIT_YEAR_SECS).contains(&secs) {
return None;
}
let (_days, y, m, d, hh, mm, ss) = split(secs);
push4(buf, 0, y);
buf[4] = b'-';
push2(buf, 5, m);
buf[7] = b'-';
push2(buf, 8, d);
buf[10] = b'T';
push2(buf, 11, hh);
buf[13] = b':';
push2(buf, 14, mm);
buf[16] = b':';
push2(buf, 17, ss);
buf[19..25].copy_from_slice(b"+00:00");
// SAFETY-free: every byte written above is ASCII.
Some(std::str::from_utf8(&buf[..]).expect("ascii"))
}
/// `chrono::DateTime<Utc>::to_rfc2822()` for a whole-second timestamp:
/// `Fri, 17 Jul 2026 11:47:14 +0000` written into `buf`.
///
/// chrono does NOT zero-pad the day (`Thu, 1 Jan 1970 …`), so the
/// rendered length is 30 or 31 bytes — the round-4 PROPFIND equivalence
/// gate caught an early padded version of this function; the sweep test
/// below pins parity byte-for-byte across 60 years.
pub fn rfc2822_utc(buf: &mut [u8; 31], secs: i64) -> Option<&str> {
if !(0..=MAX_4DIGIT_YEAR_SECS).contains(&secs) {
return None;
}
let (days, y, m, d, hh, mm, ss) = split(secs);
let weekday = WEEKDAYS[days.rem_euclid(7) as usize];
buf[0..3].copy_from_slice(weekday);
buf[3] = b',';
buf[4] = b' ';
let mut p = 5;
if d >= 10 {
buf[p] = b'0' + (d / 10) as u8;
p += 1;
}
buf[p] = b'0' + (d % 10) as u8;
p += 1;
buf[p] = b' ';
p += 1;
buf[p..p + 3].copy_from_slice(MONTHS[(m - 1) as usize]);
p += 3;
buf[p] = b' ';
p += 1;
push4(buf, p, y);
p += 4;
buf[p] = b' ';
p += 1;
push2(buf, p, hh);
p += 2;
buf[p] = b':';
p += 1;
push2(buf, p, mm);
p += 2;
buf[p] = b':';
p += 1;
push2(buf, p, ss);
p += 2;
buf[p..p + 6].copy_from_slice(b" +0000");
p += 6;
Some(std::str::from_utf8(&buf[..p]).expect("ascii"))
}
/// `u64::to_string()` without the heap `String`: renders into `buf`,
/// returns the populated tail slice.
pub fn u64_str(buf: &mut [u8; 20], mut v: u64) -> &str {
let mut pos = buf.len();
loop {
pos -= 1;
buf[pos] = b'0' + (v % 10) as u8;
v /= 10;
if v == 0 {
break;
}
}
std::str::from_utf8(&buf[pos..]).expect("ascii")
}
/// `i64::to_string()` without the heap `String` (quota bytes are `i64`).
pub fn i64_str(buf: &mut [u8; 21], v: i64) -> &str {
let mut u = [0u8; 20];
let digits = u64_str(&mut u, v.unsigned_abs());
let neg = v < 0;
let start = 21 - digits.len() - usize::from(neg);
if neg {
buf[start] = b'-';
}
buf[start + usize::from(neg)..].copy_from_slice(digits.as_bytes());
std::str::from_utf8(&buf[start..]).expect("ascii")
}
#[cfg(test)]
mod tests {
use super::*;
use chrono::{TimeZone, Utc};
/// Edge-heavy corpus: epoch, single-digit day (padding!), leap day,
/// end-of-year, DST-irrelevant midsummer, far future, max in-range.
const CASES: [i64; 12] = [
0,
1,
86_399,
86_400,
951_782_400, // 2000-02-29 (leap)
1_120_176_000, // 2005-07-01 (day < 10 → chrono pads)
1_752_753_434,
2_147_483_647,
4_102_444_799, // 2099-12-31 23:59:59
7_258_118_400,
250_000_000_000,
MAX_4DIGIT_YEAR_SECS,
];
#[test]
fn rfc3339_matches_chrono() {
for &secs in &CASES {
let dt = Utc.timestamp_opt(secs, 0).unwrap();
let mut buf = [0u8; 25];
assert_eq!(
rfc3339_utc(&mut buf, secs).expect("in range"),
dt.to_rfc3339(),
"secs={secs}"
);
}
}
#[test]
fn rfc2822_matches_chrono() {
for &secs in &CASES {
let dt = Utc.timestamp_opt(secs, 0).unwrap();
let mut buf = [0u8; 31];
assert_eq!(
rfc2822_utc(&mut buf, secs).expect("in range"),
dt.to_rfc2822(),
"secs={secs}"
);
}
}
#[test]
fn out_of_range_falls_back() {
let mut b3 = [0u8; 25];
let mut b2 = [0u8; 31];
assert!(rfc3339_utc(&mut b3, -1).is_none());
assert!(rfc2822_utc(&mut b2, -1).is_none());
assert!(rfc3339_utc(&mut b3, MAX_4DIGIT_YEAR_SECS + 1).is_none());
}
#[test]
fn ints_match_std() {
let mut b = [0u8; 20];
for v in [0u64, 1, 9, 10, 42, 1024, u64::MAX] {
assert_eq!(u64_str(&mut b, v), v.to_string());
}
let mut b = [0u8; 21];
for v in [0i64, -1, 42, -1024, i64::MIN, i64::MAX] {
assert_eq!(i64_str(&mut b, v), v.to_string());
}
}
/// Exhaustive-ish sweep: every 6h13m across 60 years — catches any
/// weekday / month-boundary drift against chrono.
#[test]
fn sweep_matches_chrono() {
let mut secs: i64 = 0;
while secs < 60 * 366 * 86_400 {
let dt = Utc.timestamp_opt(secs, 0).unwrap();
let mut b3 = [0u8; 25];
let mut b2 = [0u8; 31];
assert_eq!(rfc3339_utc(&mut b3, secs).unwrap(), dt.to_rfc3339());
assert_eq!(rfc2822_utc(&mut b2, secs).unwrap(), dt.to_rfc2822());
secs += 22_380; // 6h13m — walks through all times of day + weekdays
}
}
}
src/common/mod.rs
+1
View File
@@ -1,6 +1,7 @@
pub mod config;
pub mod di;
pub mod errors;
pub mod fmt;
pub mod locale;
pub mod mime_detect;
pub mod runtime;
src/domain/entities/calendar_event.rs
+123 -58
View File
@@ -250,25 +250,36 @@ impl CalendarEvent {
* @return Result containing the new CalendarEvent or a domain error
*/
pub fn from_ical(calendar_id: Uuid, ical_data: String) -> Result<Self> {
// This implementation would require a proper iCalendar parser
// For brevity, we're using a simplified version here
// Parse the body ONCE and read every property from the parsed
// component. The previous shape funnelled each of the 8 property
// lookups below through `extract_ical_property[_with_params]`,
// which re-ran the full `IcalParser` (line unfolding + component
// tree build) per property — 8 complete parses per VEVENT on
// every CalDAV PUT / import. A missing-or-unparseable body maps
// to the same "Missing SUMMARY" error the old first lookup
// produced, preserving error parity.
let event = Self::parse_first_vevent(&ical_data);
// Extract required fields from iCalendar data
let summary = Self::extract_ical_property(&ical_data, "SUMMARY").ok_or_else(|| {
DomainError::new(
ErrorKind::InvalidInput,
"CalendarEvent",
"Missing SUMMARY in iCalendar data",
)
})?;
// Extract required fields from the parsed component
let summary = event
.as_ref()
.and_then(|e| Self::prop_value(e, "SUMMARY"))
.ok_or_else(|| {
DomainError::new(
ErrorKind::InvalidInput,
"CalendarEvent",
"Missing SUMMARY in iCalendar data",
)
})?;
let event = event.expect("prop_value returned Some, so the parse succeeded");
// DTSTART / DTEND: use the params-aware extractor so we can
// detect `VALUE=DATE` (all-day) from the property parameters
// rather than scanning the raw property line. The pre-parser-
// rewrite substring scan couldn't see param-carrying lines at
// all — see #528.
let (dtstart_value, dtstart_params) =
Self::extract_ical_property_with_params(&ical_data, "DTSTART").ok_or_else(|| {
let (dtstart_value, dtstart_params) = Self::prop_with_params(&event, "DTSTART")
.ok_or_else(|| {
DomainError::new(
ErrorKind::InvalidInput,
"CalendarEvent",
@@ -277,7 +288,7 @@ impl CalendarEvent {
})?;
let (dtend_value, _dtend_params) =
Self::extract_ical_property_with_params(&ical_data, "DTEND").ok_or_else(|| {
Self::prop_with_params(&event, "DTEND").ok_or_else(|| {
DomainError::new(
ErrorKind::InvalidInput,
"CalendarEvent",
@@ -313,13 +324,13 @@ impl CalendarEvent {
})?;
// Extract optional fields
let description = Self::extract_ical_property(&ical_data, "DESCRIPTION");
let location = Self::extract_ical_property(&ical_data, "LOCATION");
let rrule = Self::extract_ical_property(&ical_data, "RRULE");
let description = Self::prop_value(&event, "DESCRIPTION");
let location = Self::prop_value(&event, "LOCATION");
let rrule = Self::prop_value(&event, "RRULE");
// Extract UID or generate a new one
let ical_uid = Self::extract_ical_property(&ical_data, "UID")
.unwrap_or_else(|| Uuid::new_v4().to_string());
let ical_uid =
Self::prop_value(&event, "UID").unwrap_or_else(|| Uuid::new_v4().to_string());
// RECURRENCE-ID (RFC 5545 §3.8.4.4). When present, this VEVENT
// is an override for a specific occurrence of a recurring
@@ -329,17 +340,16 @@ impl CalendarEvent {
// gets stored, just as a plain event (worst case a client sync
// treats it as a new master, which the DB uniqueness will
// refuse; better a persistence error than a silent split).
let recurrence_id =
match Self::extract_ical_property_with_params(&ical_data, "RECURRENCE-ID") {
Some((value, params)) => {
let is_date = params
.get("VALUE")
.map(|vs| vs.iter().any(|v| v.eq_ignore_ascii_case("DATE")))
.unwrap_or(false);
Self::parse_ical_datetime(&value, is_date).ok()
}
None => None,
};
let recurrence_id = match Self::prop_with_params(&event, "RECURRENCE-ID") {
Some((value, params)) => {
let is_date = params
.get("VALUE")
.map(|vs| vs.iter().any(|v| v.eq_ignore_ascii_case("DATE")))
.unwrap_or(false);
Self::parse_ical_datetime(&value, is_date).ok()
}
None => None,
};
let now = Utc::now();
@@ -627,18 +637,28 @@ impl CalendarEvent {
));
}
// Extract and update properties from iCalendar data
if let Some(summary) = Self::extract_ical_property(&ical_data, "SUMMARY") {
// Parse the body ONCE and update every property from the parsed
// component (same 8-parses→1 collapse as `from_ical`). An
// unparseable body behaves exactly like the old per-property
// lookups all returning `None`: optional fields clear, required
// fields keep their previous values.
let event = Self::parse_first_vevent(&ical_data);
if let Some(summary) = event.as_ref().and_then(|e| Self::prop_value(e, "SUMMARY")) {
self.summary = summary;
}
self.description = Self::extract_ical_property(&ical_data, "DESCRIPTION");
self.location = Self::extract_ical_property(&ical_data, "LOCATION");
self.description = event
.as_ref()
.and_then(|e| Self::prop_value(e, "DESCRIPTION"));
self.location = event.as_ref().and_then(|e| Self::prop_value(e, "LOCATION"));
// Extract DTSTART with parameters — needed for the all-day
// detection below AND for the DTSTART/DTEND datetime parsers
// (they need to know whether the value is a date or a datetime).
let dtstart_pair = Self::extract_ical_property_with_params(&ical_data, "DTSTART");
let dtstart_pair = event
.as_ref()
.and_then(|e| Self::prop_with_params(e, "DTSTART"));
let all_day = dtstart_pair
.as_ref()
.and_then(|(_v, params)| params.get("VALUE"))
@@ -652,15 +672,17 @@ impl CalendarEvent {
self.start_time = start_time;
}
if let Some((value, _params)) = Self::extract_ical_property_with_params(&ical_data, "DTEND")
if let Some((value, _params)) = event
.as_ref()
.and_then(|e| Self::prop_with_params(e, "DTEND"))
&& let Ok(end_time) = Self::parse_ical_datetime(&value, all_day)
{
self.end_time = end_time;
}
self.rrule = Self::extract_ical_property(&ical_data, "RRULE");
self.rrule = event.as_ref().and_then(|e| Self::prop_value(e, "RRULE"));
if let Some(uid) = Self::extract_ical_property(&ical_data, "UID") {
if let Some(uid) = event.as_ref().and_then(|e| Self::prop_value(e, "UID")) {
self.ical_uid = uid;
}
@@ -756,43 +778,74 @@ impl CalendarEvent {
* @param property_name The name of the property to extract
* @return Option containing the property value if found
*/
#[cfg(test)]
fn extract_ical_property(ical_data: &str, property_name: &str) -> Option<String> {
Self::extract_ical_property_with_params(ical_data, property_name).map(|(v, _p)| v)
Self::prop_value(&Self::parse_first_vevent(ical_data)?, property_name)
}
/// Extract a property's value AND parameter map. Same lookup rules
/// as `extract_ical_property`; the second element is a map keyed by
/// parameter name (`"VALUE"`, `"TZID"`, `"CN"`, …) whose value is
/// the list of parameter values (parameters can be multi-valued —
/// `MEMBER="mailto:a@x","mailto:b@x"` — hence the `Vec<String>`
/// per key).
///
/// Callers that only need the value should use `extract_ical_property`;
/// this variant is for DTSTART / DTEND / RECURRENCE-ID which need
/// `VALUE=DATE` detection to distinguish all-day from timed events.
/// Test-only sibling of [`Self::prop_with_params`] that parses the
/// raw body first. Production callers (`from_ical`,
/// `update_ical_data`) parse ONCE and use the by-reference helpers.
#[cfg(test)]
fn extract_ical_property_with_params(
ical_data: &str,
property_name: &str,
) -> Option<(String, std::collections::HashMap<String, Vec<String>>)> {
let event = Self::parse_first_vevent(ical_data)?;
Self::prop_with_params(&Self::parse_first_vevent(ical_data)?, property_name)
}
/// Read a property's trimmed value from an already-parsed VEVENT.
///
/// Value-only lookups skip the parameter-map build entirely; use
/// [`Self::prop_with_params`] for DTSTART / DTEND / RECURRENCE-ID
/// which need `VALUE=DATE` detection.
///
/// Returns `None` when the property is missing or its value is
/// empty after trimming — the same rules the old per-property
/// full-parse extractors applied.
fn prop_value(
event: &ical::parser::ical::component::IcalEvent,
property_name: &str,
) -> Option<String> {
let prop = event
.properties
.into_iter()
.iter()
.find(|p| p.name.eq_ignore_ascii_case(property_name))?;
let value = prop.value?;
if value.trim().is_empty() {
let trimmed = prop.value.as_deref()?.trim();
if trimmed.is_empty() {
return None;
}
Some(trimmed.to_string())
}
/// Read a property's trimmed value AND parameter map from an
/// already-parsed VEVENT. The map is keyed by parameter name
/// (`"VALUE"`, `"TZID"`, `"CN"`, …) whose value is the list of
/// parameter values (parameters can be multi-valued —
/// `MEMBER="mailto:a@x","mailto:b@x"` — hence the `Vec<String>`
/// per key).
fn prop_with_params(
event: &ical::parser::ical::component::IcalEvent,
property_name: &str,
) -> Option<(String, std::collections::HashMap<String, Vec<String>>)> {
let prop = event
.properties
.iter()
.find(|p| p.name.eq_ignore_ascii_case(property_name))?;
let trimmed = prop.value.as_deref()?.trim();
if trimmed.is_empty() {
return None;
}
let mut params: std::collections::HashMap<String, Vec<String>> =
std::collections::HashMap::new();
if let Some(param_list) = prop.params {
if let Some(param_list) = &prop.params {
for (name, values) in param_list {
// RFC 5545 property parameter names are ASCII case-insensitive.
// Normalise to UPPER so callers key on a canonical form.
params.insert(name.to_ascii_uppercase(), values);
params.insert(name.to_ascii_uppercase(), values.clone());
}
}
Some((value.trim().to_string(), params))
Some((trimmed.to_string(), params))
}
/// Parse a VCALENDAR body containing one or more VEVENT components
@@ -847,6 +900,18 @@ impl CalendarEvent {
let mut in_event = false;
let mut current = String::new();
// Allocation-free case-insensitive prefix test. `to_ascii_uppercase`
// maps ASCII bytes in place and leaves multi-byte chars untouched,
// so "first N bytes uppercased equal TAG" ⇔ "first N bytes
// ASCII-case-insensitively equal TAG"; `get(..N)` returning `None`
// (char straddling the boundary) implies the prefix can't be the
// all-ASCII tag. The old per-line `to_ascii_uppercase()` allocated
// a String for every line of every uploaded body.
fn starts_with_ci(line: &str, tag: &str) -> bool {
line.get(..tag.len())
.is_some_and(|p| p.eq_ignore_ascii_case(tag))
}
for raw_line in ical_data.split('\n') {
let line = raw_line.trim_end_matches('\r');
// Match the tag ignoring case, allowing surrounding
@@ -854,9 +919,9 @@ impl CalendarEvent {
// continuations — the raw-line scan sees those but they
// won't start with BEGIN/END so they slot through as
// in-event content, which is correct).
let upper = line.trim_start().to_ascii_uppercase();
let tag_area = line.trim_start();
if upper.starts_with("BEGIN:VEVENT") {
if starts_with_ci(tag_area, "BEGIN:VEVENT") {
in_event = true;
current.clear();
}
@@ -866,7 +931,7 @@ impl CalendarEvent {
current.push_str("\r\n");
}
if in_event && upper.starts_with("END:VEVENT") {
if in_event && starts_with_ci(tag_area, "END:VEVENT") {
blocks.push(std::mem::take(&mut current));
in_event = false;
}
src/domain/entities/file.rs
+62 -11
View File
@@ -1,7 +1,7 @@
use uuid::Uuid;
use crate::domain::services::path_service::{
StoragePath, normalize_storage_name, validate_storage_name,
StoragePath, normalize_storage_name_owned, validate_storage_name,
};
// Re-export entity errors from the centralized module
@@ -122,7 +122,7 @@ impl File {
mime_type: String,
folder_id: Option<String>,
) -> FileResult<Self> {
let name = normalize_storage_name(&name);
let name = normalize_storage_name_owned(name);
if let Err(reason) = validate_storage_name(&name) {
return Err(FileError::InvalidFileName(format!("{name}: {reason}")));
}
@@ -133,7 +133,7 @@ impl File {
.as_secs();
// Store the path string for serialization compatibility
let path_string = storage_path.to_string();
let path_string = storage_path.to_path_string();
Ok(Self {
id,
@@ -160,13 +160,13 @@ impl File {
created_at: u64,
modified_at: u64,
) -> FileResult<Self> {
let name = normalize_storage_name(&name);
let name = normalize_storage_name_owned(name);
if let Err(reason) = validate_storage_name(&name) {
return Err(FileError::InvalidFileName(format!("{name}: {reason}")));
}
// Store the path string for serialization compatibility
let path_string = storage_path.to_string();
let path_string = storage_path.to_path_string();
Ok(Self {
id,
@@ -252,13 +252,64 @@ impl File {
created_by: Option<Uuid>,
updated_by: Option<Uuid>,
) -> FileResult<Self> {
let name = normalize_storage_name(&name);
let name = normalize_storage_name_owned(name);
if let Err(reason) = validate_storage_name(&name) {
return Err(FileError::InvalidFileName(format!("{name}: {reason}")));
}
// Store the path string for serialization compatibility
let path_string = storage_path.to_string();
let path_string = storage_path.to_path_string();
Ok(Self {
id,
name,
storage_path,
path_string,
size,
mime_type,
folder_id,
created_at,
modified_at,
blob_hash,
created_by,
updated_by,
})
}
/// PG-row constructor: the per-listing-row hot path.
///
/// Builds `storage_path` **and** `path_string` in one pass from the
/// materialized folder path via
/// [`StoragePath::from_folder_and_name`], instead of the old chain
/// (`format!` temp → `from_string` split → `Display` re-join) that
/// allocated the full path three times per row. The owned `name` is
/// NFC-normalized without the always-copy of the borrowing variant
/// (DB rows are NFC by invariant, so this is a zero-alloc check).
///
/// The path is built from the raw incoming name and the name field is
/// normalized afterwards — the exact observable sequence of the old
/// `make_file_path` + constructor pair, byte-identical for every
/// input (for DB rows the two names coincide: stored names are NFC).
#[allow(clippy::too_many_arguments)]
pub fn from_materialized_row(
id: String,
name: String,
folder_path: Option<&str>,
size: u64,
mime_type: String,
folder_id: Option<String>,
created_at: u64,
modified_at: u64,
blob_hash: String,
created_by: Option<Uuid>,
updated_by: Option<Uuid>,
) -> FileResult<Self> {
let (storage_path, path_string) = StoragePath::from_folder_and_name(folder_path, &name);
let name = normalize_storage_name_owned(name);
if let Err(reason) = validate_storage_name(&name) {
return Err(FileError::InvalidFileName(format!("{name}: {reason}")));
}
Ok(Self {
id,
@@ -442,7 +493,7 @@ impl File {
// Create directly without validation to avoid errors in DTO
// conversions. Still NFC-normalize so even DTO-reconstructed
// entities maintain the storage invariant.
let name = normalize_storage_name(&name);
let name = normalize_storage_name_owned(name);
Self {
id,
@@ -466,7 +517,7 @@ impl File {
/// Creates a new version of the file with updated name
pub fn with_name(mut self, new_name: String) -> FileResult<Self> {
let new_name = normalize_storage_name(&new_name);
let new_name = normalize_storage_name_owned(new_name);
if let Err(reason) = validate_storage_name(&new_name) {
return Err(FileError::InvalidFileName(format!("{new_name}: {reason}")));
}
@@ -485,7 +536,7 @@ impl File {
// Consume `self` and mutate in place — only the path, name and mtime
// change; id / mime_type / folder_id / blob_hash are carried over
// without the per-field clone the old `&self` builder paid.
self.path_string = new_storage_path.to_string();
self.path_string = new_storage_path.to_path_string();
self.storage_path = new_storage_path;
self.name = new_name;
self.modified_at = now;
@@ -510,7 +561,7 @@ impl File {
.as_secs();
// Consume `self`: only the path, folder_id and mtime change.
self.path_string = new_storage_path.to_string();
self.path_string = new_storage_path.to_path_string();
self.storage_path = new_storage_path;
self.folder_id = folder_id;
self.modified_at = now;
src/domain/entities/folder.rs
+53 -9
View File
@@ -1,7 +1,7 @@
use uuid::Uuid;
use crate::domain::services::path_service::{
StoragePath, normalize_storage_name, validate_storage_name,
StoragePath, normalize_storage_name_owned, validate_storage_name,
};
// Re-export entity errors from the centralized module
@@ -120,7 +120,7 @@ impl Folder {
storage_path: StoragePath,
parent_id: Option<String>,
) -> FolderResult<Self> {
let name = normalize_storage_name(&name);
let name = normalize_storage_name_owned(name);
if let Err(reason) = validate_storage_name(&name) {
return Err(FolderError::InvalidFolderName(format!("{name}: {reason}")));
}
@@ -130,7 +130,7 @@ impl Folder {
.unwrap_or_default()
.as_secs();
let path_string = storage_path.to_string();
let path_string = storage_path.to_path_string();
Ok(Self {
id,
@@ -221,12 +221,56 @@ impl Folder {
created_by: Option<Uuid>,
updated_by: Option<Uuid>,
) -> FolderResult<Self> {
let name = normalize_storage_name(&name);
let name = normalize_storage_name_owned(name);
if let Err(reason) = validate_storage_name(&name) {
return Err(FolderError::InvalidFolderName(format!("{name}: {reason}")));
}
let path_string = storage_path.to_string();
let path_string = storage_path.to_path_string();
Ok(Self {
id,
name,
storage_path,
path_string,
parent_id,
drive_id,
created_at,
modified_at,
tree_modified_at,
created_by,
updated_by,
})
}
/// PG-row constructor: the per-listing-row hot path.
///
/// Takes the materialized `storage.folders.path` column by value and
/// splits it once via [`StoragePath::from_joined`] — when the stored
/// path is already canonical (every row the repository writes), the
/// input `String` is reused as `path_string` with zero copies,
/// replacing the old `from_string` split + `Display` re-join pair.
/// The owned `name` is NFC-normalized without the always-copy of the
/// borrowing variant (DB rows are NFC by invariant).
#[allow(clippy::too_many_arguments)]
pub fn from_materialized_row(
id: String,
name: String,
path: String,
parent_id: Option<String>,
drive_id: Uuid,
created_at: u64,
modified_at: u64,
tree_modified_at: u64,
created_by: Option<Uuid>,
updated_by: Option<Uuid>,
) -> FolderResult<Self> {
let name = normalize_storage_name_owned(name);
if let Err(reason) = validate_storage_name(&name) {
return Err(FolderError::InvalidFolderName(format!("{name}: {reason}")));
}
let (storage_path, path_string) = StoragePath::from_joined(path);
Ok(Self {
id,
@@ -411,7 +455,7 @@ impl Folder {
// round-trips lose the real rollup signal, so callers that
// need a freshly-rolled-up etag must reload from the
// repository.
let name = normalize_storage_name(&name);
let name = normalize_storage_name_owned(name);
Self {
id,
name,
@@ -437,7 +481,7 @@ impl Folder {
/// Creates a new version of the folder with updated name
pub fn with_name(&self, new_name: String) -> FolderResult<Self> {
let new_name = normalize_storage_name(&new_name);
let new_name = normalize_storage_name_owned(new_name);
if let Err(reason) = validate_storage_name(&new_name) {
return Err(FolderError::InvalidFolderName(format!(
"{new_name}: {reason}"
@@ -452,7 +496,7 @@ impl Folder {
};
// Update string representation
let new_path_string = new_storage_path.to_string();
let new_path_string = new_storage_path.to_path_string();
let now = std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
@@ -492,7 +536,7 @@ impl Folder {
};
// Update string representation
let new_path_string = new_storage_path.to_string();
let new_path_string = new_storage_path.to_path_string();
let now = std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
src/domain/repositories/address_book_repository.rs
+8
View File
@@ -24,6 +24,14 @@ pub trait AddressBookRepository: Send + Sync + 'static {
address_book: AddressBook,
) -> AddressBookRepositoryResult<AddressBook>;
async fn delete_address_book(&self, id: &Uuid) -> AddressBookRepositoryResult<()>;
/// Batch sibling of `get_address_book_by_id`: one `= ANY($1)`
/// round-trip for a page of grant-derived ids. Missing ids drop
/// out; ordering is not guaranteed.
async fn get_address_books_by_ids(
&self,
ids: &[Uuid],
) -> AddressBookRepositoryResult<Vec<AddressBook>>;
async fn get_address_book_by_id(
&self,
id: &Uuid,
src/domain/repositories/calendar_repository.rs
+6
View File
@@ -25,6 +25,12 @@ pub trait CalendarRepository: Send + Sync + 'static {
/// Finds a calendar by its ID
async fn find_calendar_by_id(&self, id: &Uuid) -> CalendarRepositoryResult<Calendar>;
/// Batch sibling of [`Self::find_calendar_by_id`]: one `= ANY($1)`
/// round-trip for a page of grant-derived ids. Missing ids drop out
/// (no per-id NotFound), matching the listing carve-out for
/// deleted/trashed races. Ordering is not guaranteed.
async fn find_calendars_by_ids(&self, ids: &[Uuid]) -> CalendarRepositoryResult<Vec<Calendar>>;
/// Lists all calendars owned by a specific user. Post-Round-3 the
/// service layer prefers `authz.list_incoming_grants` (surfaces
/// owned + shared in one union), but this direct lookup remains
src/domain/repositories/playlist_repository.rs
+5
View File
@@ -13,6 +13,11 @@ pub trait PlaylistRepository: Send + Sync + 'static {
async fn find_playlist_by_id(&self, id: &Uuid) -> PlaylistRepositoryResult<Playlist>;
/// Batch sibling of [`Self::find_playlist_by_id`]: one `= ANY($1)`
/// round-trip for a page of grant-derived ids. Missing ids drop
/// out; ordering is not guaranteed.
async fn find_playlists_by_ids(&self, ids: &[Uuid]) -> PlaylistRepositoryResult<Vec<Playlist>>;
async fn list_playlists_by_owner(
&self,
owner_id: Uuid,
src/domain/services/path_service.rs
+127 -3
View File
@@ -40,6 +40,22 @@ pub fn normalize_storage_name(name: &str) -> String {
name.nfc().collect()
}
/// Owned-input sibling of [`normalize_storage_name`].
///
/// The borrowing variant must always allocate a fresh `String` even when
/// the input is already NFC — which is every name loaded back from
/// PostgreSQL (DB invariant) and every ASCII name. Callers that own the
/// `String` (entity constructors receive `name: String` by value) were
/// paying that copy only to drop the original immediately. This variant
/// returns the input unchanged on the fast path: zero allocations per
/// row on every listing (PROPFIND, photos timeline, search).
pub fn normalize_storage_name_owned(name: String) -> String {
if is_nfc_quick(name.chars()) == IsNormalized::Yes {
return name;
}
name.nfc().collect()
}
/// Validates a single file or folder name component.
///
/// Returns `Err` with a human-readable reason if the name is rejected.
@@ -102,6 +118,88 @@ impl StoragePath {
Self { segments }
}
/// One-pass builder for PG listing rows: materialized folder path +
/// file name → `(StoragePath, path_string)`.
///
/// Replaces the old per-row chain
/// `StoragePath::from_string(&format!("{fp}/{name}"))` +
/// `storage_path.to_string()`, which allocated a joined temporary,
/// split it back into per-segment `String`s, and then re-joined those
/// segments (via `join` + `write!`) into the `path_string` the DTOs
/// actually serve. Here both representations are built in a single
/// pass with exactly one `String` for the joined form and no
/// intermediate temporaries.
///
/// Byte-equivalence with the old chain holds because concatenating
/// with a `/` separator distributes over `split('/')`:
/// `(fp + "/" + name).split('/') == fp.split('/') ⧺ name.split('/')`,
/// and the joined form is exactly `Display`'s `/`-prefixed rendering
/// of the surviving segments (root renders as `"/"`).
pub fn from_folder_and_name(folder_path: Option<&str>, file_name: &str) -> (Self, String) {
let fp = folder_path.unwrap_or("");
// Upper bounds: every byte of both inputs survives at most once,
// plus one leading '/' per segment (≤ segment count) — sizing to
// input length + 2 covers the worst case without a second scan.
let mut joined = String::with_capacity(fp.len() + file_name.len() + 2);
let mut segments: Vec<String> =
Vec::with_capacity(fp.bytes().filter(|&b| b == b'/').count() + 2);
for seg in fp
.split('/')
.chain(file_name.split('/'))
.filter(|s| Self::is_safe_segment(s))
{
joined.push('/');
joined.push_str(seg);
segments.push(seg.to_string());
}
if segments.is_empty() {
joined.push('/');
}
(Self { segments }, joined)
}
/// One-pass splitter for a pre-joined materialized path (the
/// `storage.folders.path` column) → `(StoragePath, path_string)`.
///
/// When the input is already in canonical joined form (leading `/`,
/// no empty/`.`/`..` segments, no trailing `/`) — which is every row
/// the repository writes — the input `String` is reused as the
/// `path_string` with zero copies. Non-canonical inputs fall back to
/// the filtering rebuild and produce exactly what
/// `from_string(&path).to_string()` used to.
pub fn from_joined(path: String) -> (Self, String) {
if Self::is_canonical_joined(&path) {
let segments: Vec<String> = if path.len() == 1 {
Vec::new()
} else {
path[1..].split('/').map(str::to_string).collect()
};
return (Self { segments }, path);
}
// Fallback: identical to the old from_string + to_string pair.
let segments: Vec<String> = path
.split('/')
.filter(|s| Self::is_safe_segment(s))
.map(str::to_string)
.collect();
let sp = Self { segments };
let joined = sp.to_path_string();
(sp, joined)
}
/// `true` when `path` is exactly `Display`'s canonical rendering of
/// its own segments: `"/"` alone, or `/seg(/seg)*` where every
/// segment is safe. One scan, no allocations.
fn is_canonical_joined(path: &str) -> bool {
if path == "/" {
return true;
}
if !path.starts_with('/') || path.ends_with('/') {
return false;
}
path[1..].split('/').all(Self::is_safe_segment)
}
/// Creates a path from a PathBuf
pub fn from(path_buf: PathBuf) -> Self {
let segments = path_buf
@@ -152,14 +250,40 @@ impl StoragePath {
impl std::fmt::Display for StoragePath {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
if self.segments.is_empty() {
write!(f, "/")
} else {
write!(f, "/{}", self.segments.join("/"))
return f.write_str("/");
}
// Write segments directly — the old `self.segments.join("/")`
// allocated a full joined temporary inside every `format!`/
// `to_string` of a path.
for seg in &self.segments {
f.write_str("/")?;
f.write_str(seg)?;
}
Ok(())
}
}
impl StoragePath {
/// The canonical joined form (`Display`'s output) in exactly one
/// pre-sized allocation.
///
/// `to_string()` routes through `Display` into an unsized `String`
/// that grows geometrically (multiple reallocs + copies for typical
/// path lengths). Entity constructors call this once per row on
/// every listing, so the sized single-alloc variant is the default
/// there.
pub fn to_path_string(&self) -> String {
if self.segments.is_empty() {
return "/".to_string();
}
let mut s = String::with_capacity(self.segments.iter().map(|seg| seg.len() + 1).sum());
for seg in &self.segments {
s.push('/');
s.push_str(seg);
}
s
}
/// Returns the path representation as a string
pub fn as_str(&self) -> &str {
// Note: The implementation should really store the string,
src/infrastructure/adapters/calendar_storage_adapter.rs
+5
View File
@@ -115,6 +115,11 @@ impl CalendarStoragePort for CalendarStorageAdapter {
Ok(CalendarDto::from(calendar))
}
async fn get_calendars_by_ids(&self, ids: &[Uuid]) -> Result<Vec<CalendarDto>, DomainError> {
let calendars = self.calendar_repository.find_calendars_by_ids(ids).await?;
Ok(calendars.into_iter().map(CalendarDto::from).collect())
}
async fn list_calendars_by_owner(
&self,
owner_id: Uuid,
src/infrastructure/adapters/contact_storage_adapter.rs
+9
View File
@@ -84,6 +84,15 @@ impl ContactStoragePort for ContactStorageAdapter {
.await
}
async fn get_address_books_by_ids(
&self,
ids: &[Uuid],
) -> Result<Vec<AddressBook>, DomainError> {
self.address_book_repository
.get_address_books_by_ids(ids)
.await
}
async fn get_public_address_books(&self) -> Result<Vec<AddressBook>, DomainError> {
self.address_book_repository
.get_public_address_books()
src/infrastructure/adapters/music_storage_adapter.rs
+5
View File
@@ -95,6 +95,11 @@ impl MusicStoragePort for MusicStorageAdapter {
}
}
async fn get_playlists_by_ids(&self, ids: &[Uuid]) -> Result<Vec<PlaylistDto>, DomainError> {
let playlists = self.playlist_repository.find_playlists_by_ids(ids).await?;
Ok(playlists.into_iter().map(PlaylistDto::from).collect())
}
async fn list_playlists_by_owner(
&self,
owner_id: Uuid,
src/infrastructure/repositories/pg/address_book_pg_repository.rs
+39
View File
@@ -110,6 +110,45 @@ impl AddressBookRepository for AddressBookPgRepository {
Ok(())
}
async fn get_address_books_by_ids(
&self,
ids: &[Uuid],
) -> AddressBookRepositoryResult<Vec<AddressBook>> {
if ids.is_empty() {
return Ok(Vec::new());
}
let rows = sqlx::query(
r#"
SELECT id, name, owner_id, description, color, is_public, created_at, updated_at
FROM carddav.address_books
WHERE id = ANY($1)
"#,
)
.bind(ids)
.fetch_all(&*self.pool)
.await
.map_err(|e| {
DomainError::database_error(format!("Failed to get address books by ids: {}", e))
})?;
Ok(rows
.iter()
.map(|row| {
let owner_id: Uuid = row.get("owner_id");
AddressBook::from_raw(
row.get("id"),
row.get("name"),
owner_id.to_string(),
row.get("description"),
row.get("color"),
row.get("is_public"),
row.get("created_at"),
row.get("updated_at"),
)
})
.collect())
}
async fn get_address_book_by_id(
&self,
id: &Uuid,
src/infrastructure/repositories/pg/calendar_pg_repository.rs
+36
View File
@@ -138,6 +138,42 @@ impl CalendarRepository for CalendarPgRepository {
Ok(calendar)
}
async fn find_calendars_by_ids(&self, ids: &[Uuid]) -> CalendarRepositoryResult<Vec<Calendar>> {
if ids.is_empty() {
return Ok(Vec::new());
}
let rows = sqlx::query(
r#"
SELECT id, name, owner_id, description, color, is_public, created_at, updated_at
FROM caldav.calendars
WHERE id = ANY($1)
"#,
)
.bind(ids)
.fetch_all(&*self.pool)
.await
.map_err(|e| {
DomainError::database_error(format!("Failed to get calendars by ids: {}", e))
})?;
rows.iter()
.map(|row| {
Calendar::with_id(
row.get("id"),
row.get("name"),
row.get("owner_id"),
row.get("description"),
row.get("color"),
row.get("created_at"),
row.get("updated_at"),
)
.map_err(|e| {
DomainError::database_error(format!("Failed to create calendar object: {}", e))
})
})
.collect()
}
async fn list_calendars_by_owner(
&self,
owner_id: Uuid,
src/infrastructure/repositories/pg/drive_pg_repository.rs
+129 -53
View File
@@ -41,6 +41,27 @@ pub struct DrivePgRepository {
/// provisioning idempotency check (`NotFound` → create) always sees
/// the live table.
default_drive_cache: Cache<Uuid, DriveWithRootName>,
/// caller_id → every drive the caller can read (the full
/// role_grants ⋈ drives ⋈ folders join of [`list_readable_by`],
/// including the transitive-group expansion).
///
/// Re-resolved before this cache existed on EVERY native `/webdav`
/// request that names an explicit drive selector (all verbs; MOVE
/// and COPY twice), plus per-request in search, trash listing and
/// the `GET /api/drives` picker — the heaviest per-request query
/// left on the DAV path after CHROOT-CACHE. Concurrent misses are
/// coalesced (`try_get_with`), errors are never cached.
///
/// Freshness: every membership/lifecycle mutation that flows
/// through this repository or `DriveManagementService` invalidates
/// explicitly (per-user when the subject is a User, whole cache for
/// Group subjects, whose transitive membership is not resolvable
/// here). Residual staleness — a root-folder rename or a grant
/// written by a path that can't reach this cache — is bounded by
/// the same 30 s TTL the sibling caches accept; actual permission
/// enforcement is unaffected (the ACL engine re-checks per
/// operation with its own invalidation).
readable_cache: Cache<Uuid, Arc<Vec<DriveWithRootName>>>,
}
impl DrivePgRepository {
@@ -51,9 +72,27 @@ impl DrivePgRepository {
.max_capacity(DEFAULT_DRIVE_CACHE_CAPACITY)
.time_to_live(DEFAULT_DRIVE_CACHE_TTL)
.build(),
readable_cache: Cache::builder()
.max_capacity(DEFAULT_DRIVE_CACHE_CAPACITY)
.time_to_live(DEFAULT_DRIVE_CACHE_TTL)
.build(),
}
}
/// Drop the cached readable-drive list for one user (their grant set
/// changed: membership write, personal-drive provisioning, …).
pub async fn invalidate_readable_for_user(&self, user_id: Uuid) {
self.readable_cache.invalidate(&user_id).await;
}
/// Drop every cached readable-drive list. Used when the affected
/// user set is unknown at this layer: group-subject grants, drive
/// deletion, policy edits. All are admin-rare; repopulation costs
/// one join per active caller.
pub fn invalidate_readable_all(&self) {
self.readable_cache.invalidate_all();
}
fn map_sqlx_err(context: &'static str, e: sqlx::Error) -> DriveRepositoryError {
if let sqlx::Error::Database(ref dberr) = e
&& let Some(code) = dberr.code()
@@ -112,6 +151,63 @@ impl DrivePgRepository {
dwr.caller_role = role_str.as_deref().and_then(Role::parse);
Ok(dwr)
}
/// The uncached grants join behind [`DriveRepository::list_readable_by`].
///
/// Joining role_grants → drives → folders returns every drive the
/// caller can read, paired with its display name. Group
/// memberships (direct + transitive) are expanded inline by
/// `storage.caller_group_ids($caller)` — no Rust-side ceremony.
///
/// ORDER BY puts default drives first (so the picker UI doesn't
/// need a follow-up sort), then alphabetical by name. GROUP BY
/// collapses duplicate role_grants on the same drive (direct +
/// group-mediated) and sidesteps PostgreSQL's "ORDER BY
/// expression must appear in select list" rule that SELECT
/// DISTINCT imposes.
/// `MIN(g.role)` picks the caller's strongest role on each drive:
/// `storage.grant_role` is declared `owner → viewer` (strongest →
/// weakest), so MIN returns the strongest. Cast `::text` matches
/// the codebase convention for reading enum columns into Rust
/// (see `pg_acl_engine.rs`); `Role::parse` handles the trip back.
async fn query_readable_by(
&self,
caller_id: Uuid,
) -> Result<Vec<DriveWithRootName>, DriveRepositoryError> {
let rows = sqlx::query(
r#"
SELECT d.id, d.kind, d.default_for_user, d.root_folder_id,
d.quota_bytes, d.used_bytes, d.policies,
d.created_at, d.updated_at,
f.name AS root_folder_name,
MIN(g.role)::text AS caller_role
FROM storage.drives d
JOIN storage.folders f ON f.id = d.root_folder_id
JOIN storage.role_grants g
ON g.resource_type = 'drive'
AND g.resource_id = d.id
WHERE (
(g.subject_type = 'user' AND g.subject_id = $1)
OR (g.subject_type = 'group' AND g.subject_id IN
(SELECT storage.caller_group_ids($1)))
)
AND (g.expires_at IS NULL OR g.expires_at > NOW())
GROUP BY d.id, d.kind, d.default_for_user, d.root_folder_id,
d.quota_bytes, d.used_bytes, d.policies,
d.created_at, d.updated_at, f.name
ORDER BY (d.default_for_user IS NULL) ASC,
LOWER(f.name) ASC
"#,
)
.bind(caller_id)
.fetch_all(self.pool.as_ref())
.await
.map_err(|e| Self::map_sqlx_err("list_readable_by", e))?;
rows.iter()
.map(Self::row_to_drive_with_name_and_role)
.collect()
}
}
#[async_trait::async_trait]
@@ -239,6 +335,8 @@ impl DriveRepository for DrivePgRepository {
// Drop any cached default-drive resolution for this user (a stale
// NotFound is never cached, but be explicit about the write path).
self.default_drive_cache.invalidate(&owner_id).await;
// The owner gained a drive — their readable list changed too.
self.invalidate_readable_for_user(owner_id).await;
Self::row_to_drive_with_name(&row)
}
@@ -347,6 +445,16 @@ impl DriveRepository for DrivePgRepository {
.await
.map_err(|e| Self::map_sqlx_err("create_shared_drive_atomic.commit", e))?;
// The owner grant written above changes the grantee's readable
// list. User subjects invalidate precisely; Group subjects fall
// back to a full clear (transitive members unknown here).
match owner_subject {
crate::domain::services::authorization::Subject::User(uid) => {
self.invalidate_readable_for_user(uid).await;
}
_ => self.invalidate_readable_all(),
}
Self::row_to_drive_with_name(&row)
}
@@ -425,10 +533,11 @@ impl DriveRepository for DrivePgRepository {
tx.commit()
.await
.map_err(|e| Self::map_sqlx_err("delete_atomic.commit", e))?;
// We only have the drive id here; the cache is keyed by user.
// Deletion is rare — clearing the whole cache is the simple,
// We only have the drive id here; the caches are keyed by user.
// Deletion is rare — clearing them whole is the simple,
// always-correct move (repopulates at one query per active user).
self.default_drive_cache.invalidate_all();
self.invalidate_readable_all();
Ok(())
}
@@ -513,55 +622,21 @@ impl DriveRepository for DrivePgRepository {
&self,
caller_id: Uuid,
) -> Result<Vec<DriveWithRootName>, DriveRepositoryError> {
// Joining role_grants → drives → folders returns every drive the
// caller can read, paired with its display name. Group
// memberships (direct + transitive) are expanded inline by
// `storage.caller_group_ids($caller)` — no Rust-side ceremony.
//
// ORDER BY puts default drives first (so the picker UI doesn't
// need a follow-up sort), then alphabetical by name. GROUP BY
// collapses duplicate role_grants on the same drive (direct +
// group-mediated) and sidesteps PostgreSQL's "ORDER BY
// expression must appear in select list" rule that SELECT
// DISTINCT imposes.
// `MIN(g.role)` picks the caller's strongest role on each drive:
// `storage.grant_role` is declared `owner → viewer` (strongest →
// weakest), so MIN returns the strongest. Cast `::text` matches
// the codebase convention for reading enum columns into Rust
// (see `pg_acl_engine.rs`); `Role::parse` handles the trip back.
let rows = sqlx::query(
r#"
SELECT d.id, d.kind, d.default_for_user, d.root_folder_id,
d.quota_bytes, d.used_bytes, d.policies,
d.created_at, d.updated_at,
f.name AS root_folder_name,
MIN(g.role)::text AS caller_role
FROM storage.drives d
JOIN storage.folders f ON f.id = d.root_folder_id
JOIN storage.role_grants g
ON g.resource_type = 'drive'
AND g.resource_id = d.id
WHERE (
(g.subject_type = 'user' AND g.subject_id = $1)
OR (g.subject_type = 'group' AND g.subject_id IN
(SELECT storage.caller_group_ids($1)))
)
AND (g.expires_at IS NULL OR g.expires_at > NOW())
GROUP BY d.id, d.kind, d.default_for_user, d.root_folder_id,
d.quota_bytes, d.used_bytes, d.policies,
d.created_at, d.updated_at, f.name
ORDER BY (d.default_for_user IS NULL) ASC,
LOWER(f.name) ASC
"#,
)
.bind(caller_id)
.fetch_all(self.pool.as_ref())
.await
.map_err(|e| Self::map_sqlx_err("list_readable_by", e))?;
rows.iter()
.map(Self::row_to_drive_with_name_and_role)
.collect()
// Serve from the per-user cache; concurrent misses for the same
// caller are coalesced into one join (`try_get_with`), and errors
// are never cached. See the `readable_cache` field docs for the
// freshness/invalidation contract.
let cached = self
.readable_cache
.try_get_with(caller_id, async move {
self.query_readable_by(caller_id).await.map(Arc::new)
})
.await
.map_err(|e: Arc<DriveRepositoryError>| {
Arc::try_unwrap(e)
.unwrap_or_else(|shared| DriveRepositoryError::StorageError(shared.to_string()))
})?;
Ok((*cached).clone())
}
async fn list_all(&self) -> Result<Vec<DriveWithRootName>, DriveRepositoryError> {
@@ -717,9 +792,10 @@ impl DriveRepository for DrivePgRepository {
.ok_or_else(|| DriveRepositoryError::NotFound(drive_id.to_string()))?
.0;
// Policy edits must not serve a stale `policies` bag from the
// default-drive cache (keyed by user, and we only have the drive
// id) — clear it; policy edits are admin-rare.
// user-keyed caches (we only have the drive id) — clear both;
// policy edits are admin-rare.
self.default_drive_cache.invalidate_all();
self.invalidate_readable_all();
Ok(crate::domain::entities::drive::DrivePolicies::from_value(
&raw,
))
src/infrastructure/repositories/pg/file_blob_read_repository.rs
+3 -12
View File
@@ -413,14 +413,6 @@ impl FileBlobReadRepository {
}
}
/// Build a `StoragePath` from the materialized folder path + file name.
fn make_file_path(folder_path: Option<&str>, file_name: &str) -> StoragePath {
match folder_path {
Some(fp) if !fp.is_empty() => StoragePath::from_string(&format!("{fp}/{file_name}")),
_ => StoragePath::from_string(file_name),
}
}
#[allow(clippy::too_many_arguments)]
fn row_to_file(
id: String,
@@ -435,11 +427,10 @@ impl FileBlobReadRepository {
created_by: Option<Uuid>,
updated_by: Option<Uuid>,
) -> Result<File, DomainError> {
let storage_path = Self::make_file_path(folder_path.as_deref(), &name);
File::with_timestamps_blob_hash_and_provenance(
File::from_materialized_row(
id,
name,
storage_path,
folder_path.as_deref(),
size as u64,
mime_type,
folder_id,
@@ -930,7 +921,7 @@ impl FileReadPort for FileBlobReadRepository {
.map_err(|e| DomainError::internal_error("FileBlobRead", format!("path: {e}")))?
.ok_or_else(|| DomainError::not_found("File", id))?;
Ok(Self::make_file_path(row.1.as_deref(), &row.0))
Ok(StoragePath::from_folder_and_name(row.1.as_deref(), &row.0).0)
}
async fn get_parent_folder_id(
src/infrastructure/repositories/pg/file_blob_write_repository.rs
+2 -12
View File
@@ -17,7 +17,6 @@ use crate::application::dtos::display_helpers::category_order_for;
use crate::application::ports::storage_ports::{CopyFolderTreeResult, FileWritePort};
use crate::common::errors::DomainError;
use crate::domain::entities::file::File;
use crate::domain::services::path_service::StoragePath;
use super::transaction_utils::retry_on_deadlock;
use crate::infrastructure::services::dedup_service::DedupService;
@@ -61,14 +60,6 @@ impl FileBlobWriteRepository {
}
}
/// Build a `StoragePath` from the materialized folder path + file name.
fn make_file_path(folder_path: Option<&str>, file_name: &str) -> StoragePath {
match folder_path {
Some(fp) if !fp.is_empty() => StoragePath::from_string(&format!("{fp}/{file_name}")),
_ => StoragePath::from_string(file_name),
}
}
/// Look up the materialized folder path. O(1) — no recursive CTE.
async fn lookup_folder_path(
&self,
@@ -108,11 +99,10 @@ impl FileBlobWriteRepository {
created_by: Option<Uuid>,
updated_by: Option<Uuid>,
) -> Result<File, DomainError> {
let storage_path = Self::make_file_path(folder_path.as_deref(), &name);
File::with_timestamps_blob_hash_and_provenance(
File::from_materialized_row(
id,
name,
storage_path,
folder_path.as_deref(),
size as u64,
mime_type,
folder_id,
src/infrastructure/repositories/pg/folder_db_repository.rs
+2 -3
View File
@@ -142,11 +142,10 @@ impl FolderDbRepository {
created_by: Option<Uuid>,
updated_by: Option<Uuid>,
) -> Result<Folder, DomainError> {
let storage_path = StoragePath::from_string(&path);
Folder::with_timestamps_tree_and_provenance(
Folder::from_materialized_row(
id,
name,
storage_path,
path,
parent_id,
drive_id,
created_at as u64,
src/infrastructure/repositories/pg/playlist_pg_repository.rs
+29
View File
@@ -180,6 +180,35 @@ impl PlaylistRepository for PlaylistPgRepository {
.map_err(|e| DomainError::new(ErrorKind::InternalError, "Playlist", e.to_string()))
}
async fn find_playlists_by_ids(&self, ids: &[Uuid]) -> PlaylistRepositoryResult<Vec<Playlist>> {
if ids.is_empty() {
return Ok(Vec::new());
}
let rows = sqlx::query_as::<_, PlaylistRow>(
"SELECT id, name, description, owner_id, is_public, cover_file_id, created_at, updated_at FROM audio.playlists WHERE id = ANY($1)",
)
.bind(ids)
.fetch_all(&*self.pool)
.await
.map_err(|e| DomainError::database_error(format!("Failed to find playlists: {}", e)))?;
rows.into_iter()
.map(|row| {
Playlist::with_id(
row.id,
row.name,
row.description,
row.owner_id,
row.is_public,
row.cover_file_id,
row.created_at,
row.updated_at,
)
.map_err(|e| DomainError::new(ErrorKind::InternalError, "Playlist", e.to_string()))
})
.collect()
}
async fn list_playlists_by_owner(
&self,
owner_id: Uuid,
src/infrastructure/services/azure_blob_backend.rs
+82 -42
View File
@@ -9,7 +9,7 @@ use std::pin::Pin;
use azure_storage::StorageCredentials;
use azure_storage_blobs::prelude::*;
use bytes::Bytes;
use futures::StreamExt;
use futures::{StreamExt, TryStreamExt};
use tokio::fs;
use crate::application::ports::blob_storage_ports::{
@@ -33,8 +33,21 @@ impl AzureBlobBackend {
StorageCredentials::access_key(&config.account_name, config.account_key.clone())
};
let container_client = ClientBuilder::new(&config.account_name, credentials)
.container_client(&config.container);
// Custom endpoint (Azurite emulator / private deployment /
// benches) mirrors S3's `endpoint_url`; default is the public
// cloud URL derived from the account name.
let container_client = match &config.endpoint_url {
Some(uri) => ClientBuilder::with_location(
azure_storage::CloudLocation::Custom {
account: config.account_name.clone(),
uri: uri.trim_end_matches('/').to_string(),
},
credentials,
)
.container_client(&config.container),
None => ClientBuilder::new(&config.account_name, credentials)
.container_client(&config.container),
};
Self {
container_client,
@@ -169,29 +182,46 @@ impl BlobStorageBackend for AzureBlobBackend {
Box::pin(async move {
let client = self.blob_client(&hash);
let mut result_data: Vec<u8> = Vec::new();
let mut stream = client.get().into_stream();
while let Some(response) = stream.next().await {
let response = response.map_err(|e| {
DomainError::new(
// The old implementation drained the ENTIRE blob into one
// `Vec<u8>` before yielding a single mega-chunk — whole-blob
// RAM residency per reader, and with `read_prefetch() = 8`
// up to 8 entire chunk-blobs resident at once during CDC
// reassembly. Now the SDK's page/body streams forward
// directly. The FIRST page is still awaited eagerly so a
// missing blob surfaces as the same up-front NotFound the
// old code produced; later pages/chunks map to io::Error
// items like every other backend's stream.
let mut pages = client.get().into_stream();
let first = match pages.next().await {
Some(Ok(response)) => response,
Some(Err(e)) => {
return Err(DomainError::new(
ErrorKind::NotFound,
"Azure",
format!("Failed to get blob {hash}: {e}"),
)
})?;
let mut body = response.data;
while let Some(chunk) = body.next().await {
let chunk = chunk.map_err(|e| {
DomainError::internal_error("Azure", format!("Stream read error: {e}"))
})?;
result_data.extend_from_slice(&chunk);
));
}
}
None => {
let empty: BlobStream =
Box::pin(futures::stream::once(async move { Ok(Bytes::new()) }));
return Ok(empty);
}
};
let stream: BlobStream = Box::pin(futures::stream::once(async move {
Ok(Bytes::from(result_data))
}));
let first_body = first.data.map(|chunk| {
chunk.map_err(|e| std::io::Error::other(format!("Stream read error: {e}")))
});
let tail = pages
.map(|page| match page {
Ok(response) => Ok(response.data.map(|chunk| {
chunk.map_err(|e| std::io::Error::other(format!("Stream read error: {e}")))
})),
Err(e) => Err(std::io::Error::other(format!(
"Failed to get blob page: {e}"
))),
})
.try_flatten();
let stream: BlobStream = Box::pin(first_body.chain(tail));
Ok(stream)
})
}
@@ -212,32 +242,42 @@ impl BlobStorageBackend for AzureBlobBackend {
None => azure_core::request_options::Range::new(start, u64::MAX),
};
let mut result_data: Vec<u8> = Vec::new();
let mut stream = client.get().range(range).into_stream();
while let Some(response) = stream.next().await {
let response = response.map_err(|e| {
DomainError::new(
// Same forwarding shape as `get_blob_stream` — a ranged read
// doubly so: the caller explicitly asked NOT to pay for the
// whole blob, yet the old code buffered the full range.
let mut pages = client.get().range(range).into_stream();
let first = match pages.next().await {
Some(Ok(response)) => response,
Some(Err(e)) => {
return Err(DomainError::new(
ErrorKind::NotFound,
"Azure",
format!("Failed to get blob range {hash}: {e}"),
)
})?;
let mut body = response.data;
while let Some(chunk) = body.next().await {
let chunk = chunk.map_err(|e| {
DomainError::internal_error(
"Azure",
format!("Stream range read error: {e}"),
)
})?;
result_data.extend_from_slice(&chunk);
));
}
}
None => {
let empty: BlobStream =
Box::pin(futures::stream::once(async move { Ok(Bytes::new()) }));
return Ok(empty);
}
};
let stream: BlobStream = Box::pin(futures::stream::once(async move {
Ok(Bytes::from(result_data))
}));
let first_body = first.data.map(|chunk| {
chunk.map_err(|e| std::io::Error::other(format!("Stream range read error: {e}")))
});
let tail = pages
.map(|page| match page {
Ok(response) => Ok(response.data.map(|chunk| {
chunk.map_err(|e| {
std::io::Error::other(format!("Stream range read error: {e}"))
})
})),
Err(e) => Err(std::io::Error::other(format!(
"Failed to get blob range page: {e}"
))),
})
.try_flatten();
let stream: BlobStream = Box::pin(first_body.chain(tail));
Ok(stream)
})
}
src/infrastructure/services/face_indexing_service.rs
+33
View File
@@ -28,11 +28,35 @@ fn is_image(content_type: &str) -> bool {
content_type.starts_with("image/")
}
/// Concurrent index-task budget. Env override
/// `OXICLOUD_FACES_INDEX_CONCURRENCY`, else the effective core count —
/// each task is a full-image read + decode + ONNX inference, so more
/// permits than cores only adds RAM pressure, not throughput.
fn max_concurrent_index() -> usize {
std::env::var("OXICLOUD_FACES_INDEX_CONCURRENCY")
.ok()
.and_then(|v| v.parse().ok())
.filter(|&n: &usize| n > 0)
.unwrap_or_else(|| {
std::thread::available_parallelism()
.map(|n| n.get())
.unwrap_or(2)
})
}
pub struct FaceIndexingService {
pool: Arc<PgPool>,
repo: Arc<FacePgRepository>,
analyzer: Arc<dyn FaceAnalyzerPort>,
blob_root: PathBuf,
/// Bounds concurrent indexing tasks. The lifecycle hooks spawn one
/// task per uploaded/copied image with no ceiling, so a bulk upload
/// used to fan out N simultaneous full-image reads + decodes +
/// inferences — peak RSS N × image size plus CPU thrash. Same
/// invariant as `ThumbnailService::decode_semaphore`: the permit is
/// acquired BEFORE the blob read, so peak memory is
/// `permits × image size` regardless of upload concurrency.
index_semaphore: Arc<tokio::sync::Semaphore>,
}
impl FaceIndexingService {
@@ -43,6 +67,7 @@ impl FaceIndexingService {
repo,
analyzer,
blob_root,
index_semaphore: Arc::new(tokio::sync::Semaphore::new(max_concurrent_index())),
}
}
@@ -60,7 +85,15 @@ impl FaceIndexingService {
let repo = self.repo.clone();
let analyzer = self.analyzer.clone();
let blob_path = self.blob_path(&blob_hash);
let semaphore = self.index_semaphore.clone();
tokio::spawn(async move {
// Queue behind the concurrency budget BEFORE touching the
// blob — excess tasks wait holding only this tiny future,
// not a decoded image.
let _permit = semaphore
.acquire_owned()
.await
.expect("face index semaphore never closes");
if delete_first {
let _ = repo.delete_faces_for_file(file_id).await;
}
src/interfaces/nextcloud/webdav_handler.rs
+83 -21
View File
@@ -1700,21 +1700,24 @@ pub fn write_folder_response<W: std::io::Write>(
write_text_element(xml, "d:displayname", &folder.name)?;
let created_at =
chrono::DateTime::<Utc>::from_timestamp(timestamp_to_i64(folder.created_at), 0)
.unwrap_or_else(Utc::now);
let modified_at =
chrono::DateTime::<Utc>::from_timestamp(timestamp_to_i64(folder.modified_at), 0)
.unwrap_or_else(Utc::now);
write_text_element(xml, "d:getlastmodified", &modified_at.to_rfc2822())?;
write_date_element(
xml,
"d:getlastmodified",
timestamp_to_i64(folder.modified_at),
true,
)?;
// Route through `FolderDto::etag` (= `Folder::etag()`: the
// descendant-aware `{id[..16]}-{tree_modified_at}` — see the
// entity for the formula and the async-bump freshness contract).
write_text_element(xml, "d:getetag", &format!("\"{}\"", folder.etag))?;
write_etag_element(xml, "d:getetag", &folder.etag)?;
write_text_element(xml, "d:getcontenttype", "httpd/unix-directory")?;
write_text_element(xml, "d:getcontentlength", "0")?;
write_text_element(xml, "d:creationdate", &created_at.to_rfc3339())?;
write_date_element(
xml,
"d:creationdate",
timestamp_to_i64(folder.created_at),
false,
)?;
// Nextcloud/ownCloud properties
if let Some(id) = file_id {
@@ -1795,17 +1798,28 @@ pub fn write_file_response<W: std::io::Write>(
write_text_element(xml, "d:displayname", &file.name)?;
write_text_element(xml, "d:getcontenttype", &file.mime_type)?;
write_text_element(xml, "d:getcontentlength", &file.size.to_string())?;
{
let mut buf = [0u8; 20];
write_text_element(
xml,
"d:getcontentlength",
crate::common::fmt::u64_str(&mut buf, file.size),
)?;
}
let created_at = chrono::DateTime::<Utc>::from_timestamp(timestamp_to_i64(file.created_at), 0)
.unwrap_or_else(Utc::now);
let modified_at =
chrono::DateTime::<Utc>::from_timestamp(timestamp_to_i64(file.modified_at), 0)
.unwrap_or_else(Utc::now);
write_text_element(xml, "d:getlastmodified", &modified_at.to_rfc2822())?;
write_text_element(xml, "d:getetag", &format!("\"{}\"", file.etag))?;
write_text_element(xml, "d:creationdate", &created_at.to_rfc3339())?;
write_date_element(
xml,
"d:getlastmodified",
timestamp_to_i64(file.modified_at),
true,
)?;
write_etag_element(xml, "d:getetag", &file.etag)?;
write_date_element(
xml,
"d:creationdate",
timestamp_to_i64(file.created_at),
false,
)?;
// Nextcloud/ownCloud properties
if let Some(id) = file_id {
@@ -1817,7 +1831,14 @@ pub fn write_file_response<W: std::io::Write>(
write_text_element(xml, "oc:permissions", "RGDNVW")?;
// Numeric share-permissions bitmask: Read=1 + Update=2 + Delete=8 + Share=16 = 27
write_text_element(xml, "ocs:share-permissions", "27")?;
write_text_element(xml, "oc:size", &file.size.to_string())?;
{
let mut buf = [0u8; 20];
write_text_element(
xml,
"oc:size",
crate::common::fmt::u64_str(&mut buf, file.size),
)?;
}
write_text_element(xml, "oc:owner-id", owner)?;
write_text_element(xml, "oc:owner-display-name", owner)?;
@@ -1861,6 +1882,47 @@ pub fn write_file_response<W: std::io::Write>(
Ok(())
}
/// Stack-rendered `d:getlastmodified` / `d:creationdate` bodies
/// (`common::fmt`) — the old per-row `to_rfc2822()` / `to_rfc3339()`
/// ran chrono's format interpreter and allocated a String each.
/// Out-of-range timestamps keep the chrono path, byte-identical.
fn write_date_element<W: std::io::Write>(
xml: &mut Writer<W>,
tag: &str,
secs: i64,
rfc2822: bool,
) -> Result<(), String> {
if rfc2822 {
let mut buf = [0u8; 31];
if let Some(s) = crate::common::fmt::rfc2822_utc(&mut buf, secs) {
return write_text_element(xml, tag, s);
}
let dt = chrono::DateTime::<Utc>::from_timestamp(secs, 0).unwrap_or_else(Utc::now);
write_text_element(xml, tag, &dt.to_rfc2822())
} else {
let mut buf = [0u8; 25];
if let Some(s) = crate::common::fmt::rfc3339_utc(&mut buf, secs) {
return write_text_element(xml, tag, s);
}
let dt = chrono::DateTime::<Utc>::from_timestamp(secs, 0).unwrap_or_else(Utc::now);
write_text_element(xml, tag, &dt.to_rfc3339())
}
}
/// `d:getetag` with the HTTP quoting — one exactly-sized allocation
/// instead of `format!`'s grow-from-empty.
fn write_etag_element<W: std::io::Write>(
xml: &mut Writer<W>,
tag: &str,
etag: &str,
) -> Result<(), String> {
let mut quoted = String::with_capacity(etag.len() + 2);
quoted.push('"');
quoted.push_str(etag);
quoted.push('"');
write_text_element(xml, tag, &quoted)
}
pub fn write_text_element<W: std::io::Write>(
xml: &mut Writer<W>,
tag: &str,