From 4f7e79f605d81af0b9a61d2d0891671ca1c4607a Mon Sep 17 00:00:00 2001
From: Jared Wolff <hello@jaredwolff.com>
Date: Thu, 5 Mar 2026 16:32:42 -0500
Subject: [PATCH] style: collapse nested if-let in JWT secret config (clippy)

---
 src/common/config.rs | 55 +++++++++++++++++++++-----------------------
 src/common/di.rs     |  2 --
 2 files changed, 26 insertions(+), 31 deletions(-)

diff --git a/src/common/config.rs b/src/common/config.rs
index 42dc6ee4..dd74f372 100755
--- a/src/common/config.rs
+++ b/src/common/config.rs
@@ -604,30 +604,31 @@ impl AppConfig {
         }
 
         // Auth configuration
-        if let Ok(jwt_secret) = env::var("OXICLOUD_JWT_SECRET") {
-            if !jwt_secret.is_empty() {
-                // SECURITY: Validate JWT secret minimum entropy (RFC 7518 §3.2
-                // recommends ≥256 bits for HS256). Panic on dangerously short
-                // secrets, warn on sub-optimal ones.
-                let len = jwt_secret.len();
-                if config.features.enable_auth && len < 16 {
-                    panic!(
-                        "FATAL: OXICLOUD_JWT_SECRET is dangerously short ({} bytes). \
-                         Minimum: 32 bytes (256 bits) for HS256. \
-                         Generate a secure secret with: openssl rand -hex 32",
-                        len
-                    );
-                } else if config.features.enable_auth && len < 32 {
-                    tracing::warn!("==========================================================");
-                    tracing::warn!(
-                        "OXICLOUD_JWT_SECRET is only {} bytes — recommended minimum is 32 (256 bits).",
-                        len
-                    );
-                    tracing::warn!("Generate a stronger secret with: openssl rand -hex 32");
-                    tracing::warn!("==========================================================");
-                }
-                config.auth.jwt_secret = jwt_secret;
+        if let Some(jwt_secret) = env::var("OXICLOUD_JWT_SECRET")
+            .ok()
+            .filter(|s| !s.is_empty())
+        {
+            // SECURITY: Validate JWT secret minimum entropy (RFC 7518 §3.2
+            // recommends ≥256 bits for HS256). Panic on dangerously short
+            // secrets, warn on sub-optimal ones.
+            let len = jwt_secret.len();
+            if config.features.enable_auth && len < 16 {
+                panic!(
+                    "FATAL: OXICLOUD_JWT_SECRET is dangerously short ({} bytes). \
+                     Minimum: 32 bytes (256 bits) for HS256. \
+                     Generate a secure secret with: openssl rand -hex 32",
+                    len
+                );
+            } else if config.features.enable_auth && len < 32 {
+                tracing::warn!("==========================================================");
+                tracing::warn!(
+                    "OXICLOUD_JWT_SECRET is only {} bytes — recommended minimum is 32 (256 bits).",
+                    len
+                );
+                tracing::warn!("Generate a stronger secret with: openssl rand -hex 32");
+                tracing::warn!("==========================================================");
             }
+            config.auth.jwt_secret = jwt_secret;
         }
 
         // SECURITY: Auto-persist JWT secret to storage so it survives restarts.
@@ -642,10 +643,7 @@ impl AppConfig {
                         let persisted = persisted.trim().to_string();
                         if persisted.len() >= 32 {
                             config.auth.jwt_secret = persisted;
-                            tracing::info!(
-                                "JWT secret loaded from {}",
-                                secret_file.display()
-                            );
+                            tracing::info!("JWT secret loaded from {}", secret_file.display());
                         } else {
                             tracing::warn!(
                                 "Persisted JWT secret too short ({}B), regenerating",
@@ -664,8 +662,7 @@ impl AppConfig {
                 use rand_core::{OsRng, RngCore};
                 let mut key = [0u8; 32];
                 OsRng.fill_bytes(&mut key);
-                let generated_secret: String =
-                    key.iter().map(|b| format!("{:02x}", b)).collect();
+                let generated_secret: String = key.iter().map(|b| format!("{:02x}", b)).collect();
 
                 // Persist to storage volume so it survives container restarts
                 if let Err(e) = std::fs::write(&secret_file, &generated_secret) {
diff --git a/src/common/di.rs b/src/common/di.rs
index 0e5e4925..8e4f434b 100755
--- a/src/common/di.rs
+++ b/src/common/di.rs
@@ -612,7 +612,6 @@ impl AppServiceFactory {
             path_resolver: None,
             webdav_lock_store:
                 crate::infrastructure::services::webdav_lock_service::create_webdav_lock_store(),
-
         };
 
         // 9b. Wire admin settings service when auth is available
@@ -893,7 +892,6 @@ pub struct AppState {
         Option<Arc<crate::infrastructure::services::path_resolver_service::PathResolverService>>,
     pub webdav_lock_store:
         Arc<crate::infrastructure::services::webdav_lock_service::WebDavLockStore>,
-
 }
 
 // All AppState construction is done via struct literal in build_app_state().