optimize folder search: SQL-level filtering, user isolation, no in-memory filter; batch cascade trigger

src/common/config.rs

@@ -248,8 +248,12 @@ pub struct AuthConfig {
     pub jwt_secret: String,
     pub access_token_expiry_secs: i64,
     pub refresh_token_expiry_secs: i64,
+    /// Argon2id memory cost in KiB (default 65536 = 64 MiB)
     pub hash_memory_cost: u32,
+    /// Argon2id time cost / iterations (default 3)
     pub hash_time_cost: u32,
+    /// Argon2id parallelism lanes (default 2)
+    pub hash_parallelism: u32,
 }
 
 impl Default for AuthConfig {
@@ -261,8 +265,9 @@ impl Default for AuthConfig {
             jwt_secret: String::new(),
             access_token_expiry_secs: 3600,     // 1 hour
             refresh_token_expiry_secs: 2592000, // 30 days
-            hash_memory_cost: 65536,            // 64MB
+            hash_memory_cost: 65536,            // 64 MiB
             hash_time_cost: 3,
+            hash_parallelism: 2,
         }
     }
 }
@@ -537,6 +542,23 @@ impl AppConfig {
             config.auth.refresh_token_expiry_secs = val;
         }
 
+        // Argon2 hashing parameters
+        if let Ok(v) = env::var("OXICLOUD_HASH_MEMORY_COST").map(|v| v.parse::<u32>())
+            && let Ok(val) = v
+        {
+            config.auth.hash_memory_cost = val;
+        }
+        if let Ok(v) = env::var("OXICLOUD_HASH_TIME_COST").map(|v| v.parse::<u32>())
+            && let Ok(val) = v
+        {
+            config.auth.hash_time_cost = val;
+        }
+        if let Ok(v) = env::var("OXICLOUD_HASH_PARALLELISM").map(|v| v.parse::<u32>())
+            && let Ok(val) = v
+        {
+            config.auth.hash_parallelism = val;
+        }
+
         // Feature flags
         if let Ok(enable_auth) = env::var("OXICLOUD_ENABLE_AUTH").map(|v| v.parse::<bool>())
             && let Ok(val) = enable_auth

src/common/di.rs

@@ -327,7 +327,11 @@ impl AppServiceFactory {
 
         // Build a password hasher for share password verification
         let password_hasher: Arc<dyn crate::application::ports::auth_ports::PasswordHasherPort> =
-            Arc::new(crate::infrastructure::services::password_hasher::Argon2PasswordHasher::new());
+            Arc::new(crate::infrastructure::services::password_hasher::Argon2PasswordHasher::new(
+                self.config.auth.hash_memory_cost,
+                self.config.auth.hash_time_cost,
+                self.config.auth.hash_parallelism,
+            ));
 
         let service = Arc::new(ShareService::new(
             Arc::new(self.config.clone()),

src/common/stubs.rs

@@ -621,7 +621,7 @@ pub struct StubSearchUseCase;
 
 #[async_trait]
 impl SearchUseCase for StubSearchUseCase {
-    async fn search(&self, _criteria: SearchCriteriaDto) -> Result<SearchResultsDto, DomainError> {
+    async fn search(&self, _criteria: SearchCriteriaDto, _user_id: &str) -> Result<SearchResultsDto, DomainError> {
         Ok(SearchResultsDto::empty())
     }