cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

perf: findings 6.1, 6.2, 2.6 — async Argon2, moka cache, full streaming migration

Browse Source 
- 6.1: PasswordHasherPort now async_trait with spawn_blocking for Argon2
- 6.2: OIDC pending maps migrated from std::sync::Mutex to moka::sync::Cache with TTL
- 2.6: All file download paths migrated to 64KB streaming (get_file_stream / read_blob_stream)
  - WOPI, dedup, batch ZIP, file_retrieval_service consumers migrated
  - WebDAV COPY uses zero-copy dedup (copy_file)
  - Removed dead code: get_file_content, get_file_mmap, read_blob, read_blob_bytes
    from traits, impls, stubs, and mocks (18 files touched)
This commit is contained in:
Diocrafts
2026-02-23 00:51:46 +01:00
parent b501c4052b
commit 85908311dc
18 changed files with 235 additions and 305 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/application/dtos/user_dto.rs
+2 -2
View File
@@ -2,7 +2,7 @@ use crate::domain::entities::user::User;
use chrono::{DateTime, Utc}; use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize}; use serde::{Deserialize, Serialize};
#[derive(Debug, Serialize, Deserialize)] #[derive(Debug, Clone, Serialize, Deserialize)]
pub struct UserDto { pub struct UserDto {
pub id: String, pub id: String,
pub username: String, pub username: String,
@@ -49,7 +49,7 @@ pub struct RegisterDto {
pub role: Option<String>, pub role: Option<String>,
} }
#[derive(Debug, Serialize, Deserialize)] #[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuthResponseDto { pub struct AuthResponseDto {
pub user: UserDto, pub user: UserDto,
pub access_token: String, pub access_token: String,
src/application/ports/auth_ports.rs
+6 -2
View File
@@ -11,12 +11,16 @@ use async_trait::async_trait;
/// ///
/// This trait abstracts cryptographic password operations, allowing the domain /// This trait abstracts cryptographic password operations, allowing the domain
/// layer to remain independent of specific hashing implementations (argon2, bcrypt, etc.) /// layer to remain independent of specific hashing implementations (argon2, bcrypt, etc.)
///
/// Methods are async because implementations (e.g. Argon2) are CPU-intensive
/// and must run on a blocking thread pool to avoid starving Tokio workers.
#[async_trait]
pub trait PasswordHasherPort: Send + Sync + 'static { pub trait PasswordHasherPort: Send + Sync + 'static {
/// Hash a plain text password /// Hash a plain text password
fn hash_password(&self, password: &str) -> Result<String, DomainError>; async fn hash_password(&self, password: &str) -> Result<String, DomainError>;
/// Verify a plain text password against a hash /// Verify a plain text password against a hash
fn verify_password(&self, password: &str, hash: &str) -> Result<bool, DomainError>; async fn verify_password(&self, password: &str, hash: &str) -> Result<bool, DomainError>;
} }
/// Claims contained in a JWT token /// Claims contained in a JWT token
src/application/ports/dedup_ports.rs
-8
View File
@@ -122,15 +122,7 @@ pub trait DedupPort: Send + Sync + 'static {
/// Get metadata for a blob. /// Get metadata for a blob.
async fn get_blob_metadata(&self, hash: &str) -> Option<BlobMetadataDto>; async fn get_blob_metadata(&self, hash: &str) -> Option<BlobMetadataDto>;
/// Read blob content as raw bytes.
async fn read_blob(&self, hash: &str) -> Result<Vec<u8>, DomainError>;
/// Read blob content as `Bytes`.
async fn read_blob_bytes(&self, hash: &str) -> Result<Bytes, DomainError>;
/// Stream blob content in chunks (64 KB default) — constant memory usage. /// Stream blob content in chunks (64 KB default) — constant memory usage.
///
/// Unlike `read_blob()`, this never loads the entire file into RAM.
async fn read_blob_stream( async fn read_blob_stream(
&self, &self,
hash: &str, hash: &str,
src/application/ports/file_ports.rs
-3
View File
@@ -120,9 +120,6 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
/// Lists files in a folder /// Lists files in a folder
async fn list_files(&self, folder_id: Option<&str>) -> Result<Vec<FileDto>, DomainError>; async fn list_files(&self, folder_id: Option<&str>) -> Result<Vec<FileDto>, DomainError>;
/// Gets file content as bytes (for small files)
async fn get_file_content(&self, id: &str) -> Result<Vec<u8>, DomainError>;
/// Gets file content as a stream (for large files) /// Gets file content as a stream (for large files)
async fn get_file_stream( async fn get_file_stream(
&self, &self,
src/application/ports/storage_ports.rs
-6
View File
@@ -32,9 +32,6 @@ pub trait FileReadPort: Send + Sync + 'static {
/// Lists files in a folder. /// Lists files in a folder.
async fn list_files(&self, folder_id: Option<&str>) -> Result<Vec<File>, DomainError>; async fn list_files(&self, folder_id: Option<&str>) -> Result<Vec<File>, DomainError>;
/// Gets the full content as bytes (small/medium files only).
async fn get_file_content(&self, id: &str) -> Result<Vec<u8>, DomainError>;
/// Gets content as a stream (ideal for large files). /// Gets content as a stream (ideal for large files).
async fn get_file_stream( async fn get_file_stream(
&self, &self,
@@ -49,9 +46,6 @@ pub trait FileReadPort: Send + Sync + 'static {
end: Option<u64>, end: Option<u64>,
) -> Result<Box<dyn Stream<Item = Result<Bytes, std::io::Error>> + Send>, DomainError>; ) -> Result<Box<dyn Stream<Item = Result<Bytes, std::io::Error>> + Send>, DomainError>;
/// Memory-map of a file for zero-copy access (10–100 MB).
async fn get_file_mmap(&self, id: &str) -> Result<Bytes, DomainError>;
/// Gets the logical storage path of a file. /// Gets the logical storage path of a file.
async fn get_file_path(&self, id: &str) -> Result<StoragePath, DomainError>; async fn get_file_path(&self, id: &str) -> Result<StoragePath, DomainError>;
src/application/services/auth_application_service.rs
+51 -93
View File
@@ -10,29 +10,23 @@ use crate::common::config::OidcConfig;
use crate::common::errors::{DomainError, ErrorKind}; use crate::common::errors::{DomainError, ErrorKind};
use crate::domain::entities::session::Session; use crate::domain::entities::session::Session;
use crate::domain::entities::user::{User, UserRole}; use crate::domain::entities::user::{User, UserRole};
use std::collections::HashMap; use moka::sync::Cache;
use std::path::PathBuf; use std::path::PathBuf;
use std::sync::Arc; use std::sync::Arc;
use std::sync::Mutex;
use std::sync::RwLock; use std::sync::RwLock;
use std::time::Instant; use std::time::Duration;
/// Maximum age for pending OIDC flows (10 minutes)
const OIDC_FLOW_TTL_SECS: u64 = 600;
/// Maximum age for pending one-time token codes (60 seconds)
const OIDC_TOKEN_TTL_SECS: u64 = 60;
/// Tracks a pending OIDC authorization flow (CSRF + PKCE + nonce) /// Tracks a pending OIDC authorization flow (CSRF + PKCE + nonce)
#[derive(Clone)]
struct PendingOidcFlow { struct PendingOidcFlow {
created_at: Instant,
pkce_verifier: String, pkce_verifier: String,
nonce: String, nonce: String,
} }
/// Tracks a pending one-time token exchange after successful OIDC callback /// Tracks a pending one-time token exchange after successful OIDC callback
#[derive(Clone)]
struct PendingOidcToken { struct PendingOidcToken {
auth_response: AuthResponseDto, auth_response: AuthResponseDto,
created_at: Instant,
} }
/// Interior state for OIDC — protected by RwLock for hot-reload. /// Interior state for OIDC — protected by RwLock for hot-reload.
@@ -54,10 +48,12 @@ pub struct AuthApplicationService {
/// Path to the storage directory, used for disk-space–aware quota calculation /// Path to the storage directory, used for disk-space–aware quota calculation
storage_path: PathBuf, storage_path: PathBuf,
oidc: RwLock<OidcState>, oidc: RwLock<OidcState>,
/// Pending OIDC authorization flows keyed by state token (CSRF + PKCE + nonce) /// Pending OIDC authorization flows keyed by state token (CSRF + PKCE + nonce).
pending_oidc_flows: Mutex<HashMap<String, PendingOidcFlow>>, /// Auto-expires after 10 minutes via moka TTL; max 10 000 entries for DoS protection.
/// Pending one-time token codes for secure token delivery after OIDC callback pending_oidc_flows: Cache<String, PendingOidcFlow>,
pending_oidc_tokens: Mutex<HashMap<String, PendingOidcToken>>, /// Pending one-time token codes for secure token delivery after OIDC callback.
/// Auto-expires after 60 seconds via moka TTL; max 10 000 entries for DoS protection.
pending_oidc_tokens: Cache<String, PendingOidcToken>,
} }
impl AuthApplicationService { impl AuthApplicationService {
@@ -79,8 +75,14 @@ impl AuthApplicationService {
service: None, service: None,
config: None, config: None,
}), }),
pending_oidc_flows: Mutex::new(HashMap::new()), pending_oidc_flows: Cache::builder()
pending_oidc_tokens: Mutex::new(HashMap::new()), .max_capacity(10_000)
.time_to_live(Duration::from_secs(600))
.build(),
pending_oidc_tokens: Cache::builder()
.max_capacity(10_000)
.time_to_live(Duration::from_secs(60))
.build(),
} }
} }
@@ -300,7 +302,7 @@ impl AuthApplicationService {
} }
// Hash the password using the infrastructure service // Hash the password using the infrastructure service
let password_hash = self.password_hasher.hash_password(&dto.password)?; let password_hash = self.password_hasher.hash_password(&dto.password).await?;
// Create user with the pre-generated hash // Create user with the pre-generated hash
let user = User::new(dto.username.clone(), dto.email, password_hash, role, quota).map_err( let user = User::new(dto.username.clone(), dto.email, password_hash, role, quota).map_err(
@@ -346,7 +348,8 @@ impl AuthApplicationService {
// Verify password using the injected hasher // Verify password using the injected hasher
let is_valid = self let is_valid = self
.password_hasher .password_hasher
.verify_password(&dto.password, user.password_hash())?; .verify_password(&dto.password, user.password_hash())
.await?;
if !is_valid { if !is_valid {
return Err(DomainError::new( return Err(DomainError::new(
@@ -502,7 +505,8 @@ impl AuthApplicationService {
// Verify current password using the injected hasher // Verify current password using the injected hasher
let is_valid = self let is_valid = self
.password_hasher .password_hasher
.verify_password(&dto.current_password, user.password_hash())?; .verify_password(&dto.current_password, user.password_hash())
.await?;
if !is_valid { if !is_valid {
return Err(DomainError::new( return Err(DomainError::new(
@@ -522,7 +526,7 @@ impl AuthApplicationService {
} }
// Hash new password and update user // Hash new password and update user
let new_hash = self.password_hasher.hash_password(&dto.new_password)?; let new_hash = self.password_hasher.hash_password(&dto.new_password).await?;
user.update_password_hash(new_hash); user.update_password_hash(new_hash);
// Save updated user // Save updated user
@@ -641,13 +645,7 @@ impl AuthApplicationService {
let password_hash = self let password_hash = self
.password_hasher .password_hasher
.hash_password(&dto.password) .hash_password(&dto.password)
.map_err(|e| { .await?;
DomainError::new(
ErrorKind::InternalError,
"User",
format!("Error hashing password: {}", e),
)
})?;
// Create the new admin user // Create the new admin user
let user = User::new( let user = User::new(
@@ -753,7 +751,7 @@ impl AuthApplicationService {
}); });
// Hash password // Hash password
let password_hash = self.password_hasher.hash_password(&dto.password)?; let password_hash = self.password_hasher.hash_password(&dto.password).await?;
// Create domain entity // Create domain entity
let user = let user =
@@ -806,7 +804,7 @@ impl AuthApplicationService {
"Password must be at least 8 characters long".to_string(), "Password must be at least 8 characters long".to_string(),
)); ));
} }
let hash = self.password_hasher.hash_password(new_password)?; let hash = self.password_hasher.hash_password(new_password).await?;
self.user_storage.change_password(user_id, &hash).await self.user_storage.change_password(user_id, &hash).await
} }
@@ -917,22 +915,14 @@ impl AuthApplicationService {
base64_url_encode(&hash) base64_url_encode(&hash)
}; };
// Store pending flow // Store pending flow (auto-expires after 10 min via moka TTL)
{ self.pending_oidc_flows.insert(
let mut flows = self.pending_oidc_flows.lock().unwrap(); state_token.clone(),
// Cleanup expired entries PendingOidcFlow {
let now = Instant::now(); pkce_verifier,
flows.retain(|_, f| now.duration_since(f.created_at).as_secs() < OIDC_FLOW_TTL_SECS); nonce: nonce.clone(),
},
flows.insert( );
state_token.clone(),
PendingOidcFlow {
created_at: now,
pkce_verifier,
nonce: nonce.clone(),
},
);
}
// Build authorization URL with state, nonce, and PKCE challenge // Build authorization URL with state, nonce, and PKCE challenge
let authorize_url = oidc let authorize_url = oidc
@@ -952,28 +942,15 @@ impl AuthApplicationService {
/// issue internal tokens, and return a one-time exchange code. /// issue internal tokens, and return a one-time exchange code.
pub async fn oidc_callback(&self, code: &str, state: &str) -> Result<String, DomainError> { pub async fn oidc_callback(&self, code: &str, state: &str) -> Result<String, DomainError> {
// 0. Validate CSRF state and retrieve PKCE verifier + nonce // 0. Validate CSRF state and retrieve PKCE verifier + nonce
let (pkce_verifier, nonce) = { // (entry is auto-expired by moka TTL — remove returns None if expired)
let mut flows = self.pending_oidc_flows.lock().unwrap(); let flow = self.pending_oidc_flows.remove(state).ok_or_else(|| {
let flow = flows.remove(state).ok_or_else(|| { tracing::warn!("OIDC callback with invalid/expired state token");
tracing::warn!("OIDC callback with invalid/expired state token"); DomainError::new(
DomainError::new( ErrorKind::AccessDenied, "OIDC",
ErrorKind::AccessDenied, "OIDC", "Invalid or expired OIDC state — possible CSRF attack. Please try logging in again.",
"Invalid or expired OIDC state — possible CSRF attack. Please try logging in again.", )
) })?;
})?; let (pkce_verifier, nonce) = (flow.pkce_verifier, flow.nonce);
// Check TTL
if Instant::now().duration_since(flow.created_at).as_secs() >= OIDC_FLOW_TTL_SECS {
tracing::warn!("OIDC callback with expired state token");
return Err(DomainError::new(
ErrorKind::AccessDenied,
"OIDC",
"OIDC authorization flow expired. Please try logging in again.",
));
}
(flow.pkce_verifier, flow.nonce)
};
// Clone the Arc and config out of the RwLock so we don't hold the lock across await points // Clone the Arc and config out of the RwLock so we don't hold the lock across await points
let (oidc, oidc_config) = { let (oidc, oidc_config) = {
@@ -1178,20 +1155,11 @@ impl AuthApplicationService {
OsRng.fill_bytes(&mut code_bytes); OsRng.fill_bytes(&mut code_bytes);
let exchange_code = hex::encode(code_bytes); let exchange_code = hex::encode(code_bytes);
{ // Store auth response (auto-expires after 60 s via moka TTL)
let mut tokens = self.pending_oidc_tokens.lock().unwrap(); self.pending_oidc_tokens.insert(
// Cleanup expired entries exchange_code.clone(),
let now = Instant::now(); PendingOidcToken { auth_response },
tokens.retain(|_, t| now.duration_since(t.created_at).as_secs() < OIDC_TOKEN_TTL_SECS); );
tokens.insert(
exchange_code.clone(),
PendingOidcToken {
auth_response,
created_at: now,
},
);
}
tracing::info!("OIDC login successful, one-time exchange code generated"); tracing::info!("OIDC login successful, one-time exchange code generated");
@@ -1199,10 +1167,9 @@ impl AuthApplicationService {
} }
/// Exchange a one-time code for the authentication tokens. /// Exchange a one-time code for the authentication tokens.
/// The code is single-use and expires after 60 seconds. /// The code is single-use and expires after 60 seconds (moka TTL).
pub fn exchange_oidc_token(&self, one_time_code: &str) -> Result<AuthResponseDto, DomainError> { pub fn exchange_oidc_token(&self, one_time_code: &str) -> Result<AuthResponseDto, DomainError> {
let mut tokens = self.pending_oidc_tokens.lock().unwrap(); let pending = self.pending_oidc_tokens.remove(one_time_code).ok_or_else(|| {
let pending = tokens.remove(one_time_code).ok_or_else(|| {
DomainError::new( DomainError::new(
ErrorKind::AccessDenied, ErrorKind::AccessDenied,
"OIDC", "OIDC",
@@ -1210,15 +1177,6 @@ impl AuthApplicationService {
) )
})?; })?;
// Check TTL
if Instant::now().duration_since(pending.created_at).as_secs() >= OIDC_TOKEN_TTL_SECS {
return Err(DomainError::new(
ErrorKind::AccessDenied,
"OIDC",
"Exchange code expired. Please try logging in again.",
));
}
Ok(pending.auth_response) Ok(pending.auth_response)
} }
src/application/services/batch_operations.rs
+29 -9
View File
@@ -1,4 +1,4 @@
use futures::{Future, future::join_all}; use futures::{Future, StreamExt, future::join_all};
use std::sync::Arc; use std::sync::Arc;
use thiserror::Error; use thiserror::Error;
use tokio::sync::Semaphore; use tokio::sync::Semaphore;
@@ -702,18 +702,30 @@ impl BatchOperationService {
// Add individual files at the root of the ZIP // Add individual files at the root of the ZIP
for file_id in &file_ids { for file_id in &file_ids {
match self.file_retrieval.get_file(file_id).await { match self.file_retrieval.get_file(file_id).await {
Ok(file_dto) => match self.file_retrieval.get_file_content(file_id).await { Ok(file_dto) => match self.file_retrieval.get_file_stream(file_id).await {
Ok(content) => { Ok(stream) => {
let mut stream = std::pin::Pin::from(stream);
if let Err(e) = zip.start_file(&file_dto.name, options) { if let Err(e) = zip.start_file(&file_dto.name, options) {
info!("Could not start zip entry for {}: {}", file_dto.name, e); info!("Could not start zip entry for {}: {}", file_dto.name, e);
continue; continue;
} }
if let Err(e) = zip.write_all(&content) { while let Some(chunk) = stream.next().await {
info!("Could not write zip entry for {}: {}", file_dto.name, e); match chunk {
Ok(bytes) => {
if let Err(e) = zip.write_all(&bytes) {
info!("Could not write zip chunk for {}: {}", file_dto.name, e);
break;
}
}
Err(e) => {
info!("Stream error for {}: {}", file_dto.name, e);
break;
}
}
} }
} }
Err(e) => { Err(e) => {
info!("Could not read file content {}: {}", file_id, e); info!("Could not stream file content {}: {}", file_id, e);
} }
}, },
Err(e) => { Err(e) => {
@@ -805,13 +817,21 @@ impl BatchOperationService {
let dir_path = format!("{}/", current.path); let dir_path = format!("{}/", current.path);
let _ = zip.add_directory(&dir_path, *options); let _ = zip.add_directory(&dir_path, *options);
// Add files // Add files via streaming (constant ~64 KB memory per file)
if let Ok(files) = self.file_retrieval.list_files(Some(&current.id)).await { if let Ok(files) = self.file_retrieval.list_files(Some(&current.id)).await {
for file in files { for file in files {
let file_path = format!("{}{}", dir_path, file.name); let file_path = format!("{}{}", dir_path, file.name);
if let Ok(content) = self.file_retrieval.get_file_content(&file.id).await { if let Ok(stream) = self.file_retrieval.get_file_stream(&file.id).await {
let mut stream = std::pin::Pin::from(stream);
if zip.start_file(&file_path, *options).is_ok() { if zip.start_file(&file_path, *options).is_ok() {
let _ = zip.write_all(&content); while let Some(chunk) = stream.next().await {
match chunk {
Ok(bytes) => {
let _ = zip.write_all(&bytes);
}
Err(_) => break,
}
}
} }
} }
} }
src/application/services/file_retrieval_service.rs
+15 -25
View File
@@ -1,6 +1,6 @@
use async_trait::async_trait; use async_trait::async_trait;
use bytes::Bytes; use bytes::{Bytes, BytesMut};
use futures::Stream; use futures::{Stream, StreamExt};
use std::sync::Arc; use std::sync::Arc;
use crate::application::dtos::file_dto::FileDto; use crate::application::dtos::file_dto::FileDto;
@@ -9,7 +9,7 @@ use crate::application::ports::file_ports::{FileRetrievalUseCase, OptimizedFileC
use crate::application::ports::storage_ports::FileReadPort; use crate::application::ports::storage_ports::FileReadPort;
use crate::application::ports::transcode_ports::{ImageTranscodePort, OutputFormat}; use crate::application::ports::transcode_ports::{ImageTranscodePort, OutputFormat};
use crate::common::errors::DomainError; use crate::common::errors::DomainError;
use tracing::{debug, info, warn}; use tracing::{debug, info};
/// Threshold below which files are served from RAM cache (10 MB). /// Threshold below which files are served from RAM cache (10 MB).
const CACHE_THRESHOLD: u64 = 10 * 1024 * 1024; const CACHE_THRESHOLD: u64 = 10 * 1024 * 1024;
@@ -183,10 +183,17 @@ impl FileRetrievalService {
)); ));
} }
// Cache miss – load from disk // Cache miss – load from disk via streaming (constant 64 KB memory)
debug!("💾 TIER 1 Cache MISS: {} – loading from disk", file_name); debug!("💾 TIER 1 Cache MISS: {} – loading from disk", file_name);
let content = self.file_read.get_file_content(id).await?; let stream = self.file_read.get_file_stream(id).await?;
let content_bytes = Bytes::from(content); let mut stream = std::pin::Pin::from(stream);
let mut buf = BytesMut::with_capacity(file_size as usize);
while let Some(chunk) = stream.next().await {
buf.extend_from_slice(&chunk.map_err(|e| {
DomainError::internal_error("File", format!("Stream read error: {}", e))
})?);
}
let content_bytes = buf.freeze();
// Store in cache // Store in cache
if let Some(cache) = &self.content_cache { if let Some(cache) = &self.content_cache {
@@ -231,21 +238,8 @@ impl FileRetrievalService {
file_name, file_name,
file_size / (1024 * 1024) file_size / (1024 * 1024)
); );
match self.file_read.get_file_stream(id).await { let stream = self.file_read.get_file_stream(id).await?;
Ok(stream) => Ok((dto, OptimizedFileContent::Stream(Box::into_pin(stream)))), Ok((dto, OptimizedFileContent::Stream(Box::into_pin(stream))))
Err(e) => {
warn!("Streaming failed, last-resort content load: {}", e);
let content = self.file_read.get_file_content(id).await?;
Ok((
dto,
OptimizedFileContent::Bytes {
data: Bytes::from(content),
mime_type: mime_type.clone(),
was_transcoded: false,
},
))
}
}
} }
} }
@@ -273,10 +267,6 @@ impl FileRetrievalUseCase for FileRetrievalService {
Ok(files.into_iter().map(FileDto::from).collect()) Ok(files.into_iter().map(FileDto::from).collect())
} }
async fn get_file_content(&self, id: &str) -> Result<Vec<u8>, DomainError> {
self.file_read.get_file_content(id).await
}
async fn get_file_stream( async fn get_file_stream(
&self, &self,
id: &str, id: &str,
src/application/services/share_service.rs
+4 -11
View File
@@ -348,7 +348,7 @@ impl ShareUseCase for ShareService {
// Verify the password using the infrastructure port // Verify the password using the infrastructure port
match share.password_hash() { match share.password_hash() {
Some(hash) => self.password_hasher.verify_password(password, hash), Some(hash) => self.password_hasher.verify_password(password, hash).await,
None => Ok(true), // No password required None => Ok(true), // No password required
} }
} }
@@ -395,12 +395,13 @@ mod tests {
struct MockPasswordHasher; struct MockPasswordHasher;
#[async_trait]
impl PasswordHasherPort for MockPasswordHasher { impl PasswordHasherPort for MockPasswordHasher {
fn hash_password(&self, password: &str) -> Result<String, DomainError> { async fn hash_password(&self, password: &str) -> Result<String, DomainError> {
Ok(format!("hashed_{}", password)) Ok(format!("hashed_{}", password))
} }
fn verify_password(&self, _password: &str, _hash: &str) -> Result<bool, DomainError> { async fn verify_password(&self, _password: &str, _hash: &str) -> Result<bool, DomainError> {
Ok(true) Ok(true)
} }
} }
@@ -439,10 +440,6 @@ mod tests {
unimplemented!() unimplemented!()
} }
async fn get_file_content(&self, _id: &str) -> Result<Vec<u8>, DomainError> {
unimplemented!()
}
async fn get_file_stream( async fn get_file_stream(
&self, &self,
_id: &str, _id: &str,
@@ -465,10 +462,6 @@ mod tests {
unimplemented!() unimplemented!()
} }
async fn get_file_mmap(&self, _id: &str) -> Result<bytes::Bytes, DomainError> {
unimplemented!()
}
async fn get_file_path( async fn get_file_path(
&self, &self,
_id: &str, _id: &str,
src/application/services/trash_service_test.rs
-8
View File
@@ -142,10 +142,6 @@ impl FileReadPort for MockFileRepository {
Ok(vec![]) Ok(vec![])
} }
async fn get_file_content(&self, _id: &str) -> std::result::Result<Vec<u8>, DomainError> {
Ok(vec![])
}
async fn get_file_stream( async fn get_file_stream(
&self, &self,
_id: &str, _id: &str,
@@ -168,10 +164,6 @@ impl FileReadPort for MockFileRepository {
unimplemented!() unimplemented!()
} }
async fn get_file_mmap(&self, _id: &str) -> std::result::Result<Bytes, DomainError> {
unimplemented!()
}
async fn get_file_path(&self, _id: &str) -> std::result::Result<StoragePath, DomainError> { async fn get_file_path(&self, _id: &str) -> std::result::Result<StoragePath, DomainError> {
unimplemented!() unimplemented!()
} }
src/common/stubs.rs
-26
View File
@@ -74,10 +74,6 @@ impl FileReadPort for StubFileReadPort {
Ok(Vec::new()) Ok(Vec::new())
} }
async fn get_file_content(&self, _id: &str) -> Result<Vec<u8>, DomainError> {
Ok(Vec::new())
}
async fn get_file_stream( async fn get_file_stream(
&self, &self,
_id: &str, _id: &str,
@@ -96,10 +92,6 @@ impl FileReadPort for StubFileReadPort {
Ok(Box::new(empty_stream)) Ok(Box::new(empty_stream))
} }
async fn get_file_mmap(&self, _id: &str) -> Result<Bytes, DomainError> {
Ok(Bytes::new())
}
async fn get_file_path(&self, _id: &str) -> Result<StoragePath, DomainError> { async fn get_file_path(&self, _id: &str) -> Result<StoragePath, DomainError> {
Ok(StoragePath::from_string("/")) Ok(StoragePath::from_string("/"))
} }
@@ -525,10 +517,6 @@ impl FileRetrievalUseCase for StubFileRetrievalUseCase {
Ok(Vec::new()) Ok(Vec::new())
} }
async fn get_file_content(&self, _id: &str) -> Result<Vec<u8>, DomainError> {
Ok(Vec::new())
}
async fn get_file_stream( async fn get_file_stream(
&self, &self,
_id: &str, _id: &str,
@@ -697,20 +685,6 @@ impl DedupPort for StubDedupPort {
None None
} }
async fn read_blob(&self, _hash: &str) -> Result<Vec<u8>, DomainError> {
Err(DomainError::internal_error(
"DedupService",
"DedupService not initialized",
))
}
async fn read_blob_bytes(&self, _hash: &str) -> Result<Bytes, DomainError> {
Err(DomainError::internal_error(
"DedupService",
"DedupService not initialized",
))
}
async fn read_blob_stream( async fn read_blob_stream(
&self, &self,
_hash: &str, _hash: &str,
src/domain/repositories/file_repository.rs
-6
View File
@@ -34,9 +34,6 @@ pub trait FileReadRepository: Send + Sync + 'static {
/// Lists files in a folder. /// Lists files in a folder.
async fn list_files(&self, folder_id: Option<&str>) -> Result<Vec<File>, DomainError>; async fn list_files(&self, folder_id: Option<&str>) -> Result<Vec<File>, DomainError>;
/// Gets full content as bytes (only for small/medium files).
async fn get_file_content(&self, id: &str) -> Result<Vec<u8>, DomainError>;
/// Gets content as a stream (ideal for large files). /// Gets content as a stream (ideal for large files).
async fn get_file_stream( async fn get_file_stream(
&self, &self,
@@ -51,9 +48,6 @@ pub trait FileReadRepository: Send + Sync + 'static {
end: Option<u64>, end: Option<u64>,
) -> Result<Box<dyn Stream<Item = Result<Bytes, std::io::Error>> + Send>, DomainError>; ) -> Result<Box<dyn Stream<Item = Result<Bytes, std::io::Error>> + Send>, DomainError>;
/// Memory-mapped file for zero-copy access (10–100 MB).
async fn get_file_mmap(&self, id: &str) -> Result<Bytes, DomainError>;
/// Gets the logical storage path of a file. /// Gets the logical storage path of a file.
async fn get_file_path(&self, id: &str) -> Result<StoragePath, DomainError>; async fn get_file_path(&self, id: &str) -> Result<StoragePath, DomainError>;
src/infrastructure/repositories/pg/file_blob_read_repository.rs
-12
View File
@@ -207,11 +207,6 @@ impl FileReadPort for FileBlobReadRepository {
self.resolve_blob_hash(file_id).await self.resolve_blob_hash(file_id).await
} }
async fn get_file_content(&self, id: &str) -> Result<Vec<u8>, DomainError> {
let blob_hash = self.resolve_blob_hash(id).await?;
self.dedup.read_blob(&blob_hash).await
}
async fn get_file_stream( async fn get_file_stream(
&self, &self,
id: &str, id: &str,
@@ -239,13 +234,6 @@ impl FileReadPort for FileBlobReadRepository {
Ok(Box::new(stream)) Ok(Box::new(stream))
} }
async fn get_file_mmap(&self, id: &str) -> Result<Bytes, DomainError> {
// For RPi targets, mmap is less beneficial than streaming.
// Keep as a fallback that loads content for small/medium files.
let blob_hash = self.resolve_blob_hash(id).await?;
self.dedup.read_blob_bytes(&blob_hash).await
}
async fn get_file_path(&self, id: &str) -> Result<StoragePath, DomainError> { async fn get_file_path(&self, id: &str) -> Result<StoragePath, DomainError> {
let row = sqlx::query_as::<_, (String, Option<String>)>( let row = sqlx::query_as::<_, (String, Option<String>)>(
r#" r#"
src/infrastructure/services/dedup_service.rs
+26 -43
View File
@@ -31,7 +31,7 @@ use std::path::{Path, PathBuf};
use std::pin::Pin; use std::pin::Pin;
use std::sync::Arc; use std::sync::Arc;
use tokio::fs::{self, File}; use tokio::fs::{self, File};
use tokio::io::{AsyncReadExt, AsyncSeekExt, BufReader}; use tokio::io::{AsyncReadExt, AsyncSeekExt};
use tokio_util::io::ReaderStream; use tokio_util::io::ReaderStream;
use crate::application::ports::dedup_ports::{ use crate::application::ports::dedup_ports::{
@@ -39,10 +39,10 @@ use crate::application::ports::dedup_ports::{
}; };
use crate::domain::errors::{DomainError, ErrorKind}; use crate::domain::errors::{DomainError, ErrorKind};
/// Chunk size for streaming hash calculation (256KB) /// Block size for SHA-256 file hashing (1MB — optimal syscall/throughput ratio).
const HASH_CHUNK_SIZE: usize = 256 * 1024; const HASH_BLOCK_SIZE: usize = 1024 * 1024;
/// Chunk size for streaming file reads (256 KB — 4x fewer iterations) /// Chunk size for streaming file reads (256 KB)
const STREAM_CHUNK_SIZE: usize = 256 * 1024; const STREAM_CHUNK_SIZE: usize = 256 * 1024;
/// Content-Addressable Storage Service (PostgreSQL-backed) /// Content-Addressable Storage Service (PostgreSQL-backed)
@@ -124,22 +124,32 @@ impl DedupService {
hex::encode(hasher.finalize()) hex::encode(hasher.finalize())
} }
/// Calculate SHA-256 hash of a file (streaming). /// Calculate SHA-256 hash of a file.
///
/// Runs entirely on `spawn_blocking` with synchronous I/O so the Tokio
/// worker threads are never blocked by CPU-bound hashing. Uses 1 MB
/// reads for optimal syscall-to-throughput ratio (~3.8 GB/s on NVMe).
pub async fn hash_file(path: &Path) -> std::io::Result<String> { pub async fn hash_file(path: &Path) -> std::io::Result<String> {
let file = File::open(path).await?; let path = path.to_path_buf();
let mut reader = BufReader::with_capacity(HASH_CHUNK_SIZE, file); tokio::task::spawn_blocking(move || {
let mut hasher = Sha256::new(); use std::io::Read;
let mut buffer = vec![0u8; HASH_CHUNK_SIZE];
loop { let mut file = std::fs::File::open(&path)?;
let bytes_read = reader.read(&mut buffer).await?; let mut hasher = Sha256::new();
if bytes_read == 0 { let mut buffer = vec![0u8; HASH_BLOCK_SIZE];
break;
loop {
let n = file.read(&mut buffer)?;
if n == 0 {
break;
}
hasher.update(&buffer[..n]);
} }
hasher.update(&buffer[..bytes_read]);
}
Ok(hex::encode(hasher.finalize())) Ok(hex::encode(hasher.finalize()))
})
.await
.expect("hash_file: spawn_blocking task panicked")
} }
// ── Core store operations ──────────────────────────────────── // ── Core store operations ────────────────────────────────────
@@ -515,27 +525,8 @@ impl DedupService {
// ── Read operations ────────────────────────────────────────── // ── Read operations ──────────────────────────────────────────
/// Read blob content from the filesystem.
pub async fn read_blob(&self, hash: &str) -> Result<Vec<u8>, DomainError> {
let blob_path = self.blob_path(hash);
fs::read(&blob_path).await.map_err(|e| {
DomainError::new(
ErrorKind::NotFound,
"Blob",
format!("Failed to read blob {}: {}", hash, e),
)
})
}
/// Read blob content as Bytes.
pub async fn read_blob_bytes(&self, hash: &str) -> Result<Bytes, DomainError> {
self.read_blob(hash).await.map(Bytes::from)
}
/// Stream blob content in 64 KB chunks — constant memory (~64 KB per stream). /// Stream blob content in 64 KB chunks — constant memory (~64 KB per stream).
/// ///
/// Unlike `read_blob()`, this never loads the entire file into RAM.
/// A 1 GB file uses the same ~64 KB as a 1 KB file. /// A 1 GB file uses the same ~64 KB as a 1 KB file.
pub async fn read_blob_stream( pub async fn read_blob_stream(
&self, &self,
@@ -772,14 +763,6 @@ impl DedupPort for DedupService {
self.get_blob_metadata(hash).await self.get_blob_metadata(hash).await
} }
async fn read_blob(&self, hash: &str) -> Result<Vec<u8>, DomainError> {
self.read_blob(hash).await
}
async fn read_blob_bytes(&self, hash: &str) -> Result<Bytes, DomainError> {
self.read_blob_bytes(hash).await
}
async fn read_blob_stream( async fn read_blob_stream(
&self, &self,
hash: &str, hash: &str,
src/infrastructure/services/password_hasher.rs
+64 -30
View File
@@ -2,9 +2,14 @@
//! //!
//! This module provides a secure password hashing implementation using the Argon2id //! This module provides a secure password hashing implementation using the Argon2id
//! algorithm, which is the recommended choice for password hashing as of 2023+. //! algorithm, which is the recommended choice for password hashing as of 2023+.
//!
//! Both `hash_password` and `verify_password` are CPU-intensive (~300-500 ms with
//! default parameters) so they run inside `spawn_blocking` to avoid blocking Tokio
//! worker threads.
use argon2::password_hash::SaltString; use argon2::password_hash::SaltString;
use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier}; use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
use async_trait::async_trait;
use rand_core::OsRng; use rand_core::OsRng;
use crate::application::ports::auth_ports::PasswordHasherPort; use crate::application::ports::auth_ports::PasswordHasherPort;
@@ -14,9 +19,11 @@ use crate::common::errors::{DomainError, ErrorKind};
/// ///
/// Uses Argon2id algorithm which provides resistance against both side-channel /// Uses Argon2id algorithm which provides resistance against both side-channel
/// and GPU-based attacks. This is the recommended algorithm for password hashing. /// and GPU-based attacks. This is the recommended algorithm for password hashing.
///
/// The struct is stateless — `Argon2::default()` is constructed per call inside
/// `spawn_blocking` so it is `Send` without extra synchronisation.
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
pub struct Argon2PasswordHasher { pub struct Argon2PasswordHasher {
/// Argon2 hasher instance - uses default secure parameters
_private: (), _private: (),
} }
@@ -33,35 +40,57 @@ impl Default for Argon2PasswordHasher {
} }
} }
#[async_trait]
impl PasswordHasherPort for Argon2PasswordHasher { impl PasswordHasherPort for Argon2PasswordHasher {
fn hash_password(&self, password: &str) -> Result<String, DomainError> { async fn hash_password(&self, password: &str) -> Result<String, DomainError> {
let salt = SaltString::generate(&mut OsRng); let pwd = password.to_owned();
let argon2 = Argon2::default(); tokio::task::spawn_blocking(move || {
let salt = SaltString::generate(&mut OsRng);
argon2 Argon2::default()
.hash_password(password.as_bytes(), &salt) .hash_password(pwd.as_bytes(), &salt)
.map(|hash| hash.to_string()) .map(|hash| hash.to_string())
.map_err(|e| { .map_err(|e| {
DomainError::new( DomainError::new(
ErrorKind::InternalError, ErrorKind::InternalError,
"PasswordHasher", "PasswordHasher",
format!("Error generating password hash: {}", e), format!("Error generating password hash: {}", e),
) )
}) })
} })
.await
fn verify_password(&self, password: &str, hash: &str) -> Result<bool, DomainError> { .map_err(|e| {
let parsed_hash = PasswordHash::new(hash).map_err(|e| {
DomainError::new( DomainError::new(
ErrorKind::InternalError, ErrorKind::InternalError,
"PasswordHasher", "PasswordHasher",
format!("Error processing password hash: {}", e), format!("Task join error: {}", e),
) )
})?; })?
}
Ok(Argon2::default() async fn verify_password(&self, password: &str, hash: &str) -> Result<bool, DomainError> {
.verify_password(password.as_bytes(), &parsed_hash) let pwd = password.to_owned();
.is_ok()) let hash = hash.to_owned();
tokio::task::spawn_blocking(move || {
let parsed_hash = PasswordHash::new(&hash).map_err(|e| {
DomainError::new(
ErrorKind::InternalError,
"PasswordHasher",
format!("Error processing password hash: {}", e),
)
})?;
Ok(Argon2::default()
.verify_password(pwd.as_bytes(), &parsed_hash)
.is_ok())
})
.await
.map_err(|e| {
DomainError::new(
ErrorKind::InternalError,
"PasswordHasher",
format!("Task join error: {}", e),
)
})?
} }
} }
@@ -69,33 +98,36 @@ impl PasswordHasherPort for Argon2PasswordHasher {
mod tests { mod tests {
use super::*; use super::*;
#[test] #[tokio::test]
fn test_hash_and_verify_password() { async fn test_hash_and_verify_password() {
let hasher = Argon2PasswordHasher::new(); let hasher = Argon2PasswordHasher::new();
let password = "test_password_123"; let password = "test_password_123";
let hash = hasher let hash = hasher
.hash_password(password) .hash_password(password)
.await
.expect("Should hash password"); .expect("Should hash password");
assert!( assert!(
hasher hasher
.verify_password(password, &hash) .verify_password(password, &hash)
.await
.expect("Should verify") .expect("Should verify")
); );
assert!( assert!(
!hasher !hasher
.verify_password("wrong_password", &hash) .verify_password("wrong_password", &hash)
.await
.expect("Should verify") .expect("Should verify")
); );
} }
#[test] #[tokio::test]
fn test_different_hashes_for_same_password() { async fn test_different_hashes_for_same_password() {
let hasher = Argon2PasswordHasher::new(); let hasher = Argon2PasswordHasher::new();
let password = "same_password"; let password = "same_password";
let hash1 = hasher.hash_password(password).expect("Should hash"); let hash1 = hasher.hash_password(password).await.expect("Should hash");
let hash2 = hasher.hash_password(password).expect("Should hash"); let hash2 = hasher.hash_password(password).await.expect("Should hash");
// Hashes should be different due to random salt // Hashes should be different due to random salt
assert_ne!(hash1, hash2); assert_ne!(hash1, hash2);
@@ -104,11 +136,13 @@ mod tests {
assert!( assert!(
hasher hasher
.verify_password(password, &hash1) .verify_password(password, &hash1)
.await
.expect("Should verify") .expect("Should verify")
); );
assert!( assert!(
hasher hasher
.verify_password(password, &hash2) .verify_password(password, &hash2)
.await
.expect("Should verify") .expect("Should verify")
); );
} }
src/interfaces/api/handlers/dedup_handler.rs
+17 -4
View File
@@ -313,13 +313,26 @@ impl DedupHandler {
.and_then(|m| m.content_type.clone()) .and_then(|m| m.content_type.clone())
.unwrap_or_else(|| "application/octet-stream".to_string()); .unwrap_or_else(|| "application/octet-stream".to_string());
match dedup.read_blob_bytes(&hash).await { // Stream blob in 64 KB chunks — constant memory regardless of size
Ok(content) => Response::builder() let size = match dedup.blob_size(&hash).await {
Ok(s) => s,
Err(_) => {
return Response::builder()
.status(StatusCode::NOT_FOUND)
.header(header::CONTENT_TYPE, "application/json")
.body(Body::from(r#"{"error": "Blob not found"}"#))
.unwrap()
.into_response();
}
};
match dedup.read_blob_stream(&hash).await {
Ok(stream) => Response::builder()
.status(StatusCode::OK) .status(StatusCode::OK)
.header(header::CONTENT_TYPE, content_type) .header(header::CONTENT_TYPE, content_type)
.header(header::CONTENT_LENGTH, content.len().to_string()) .header(header::CONTENT_LENGTH, size.to_string())
.header("X-Dedup-Hash", &hash) .header("X-Dedup-Hash", &hash)
.body(Body::from(content)) .body(Body::from_stream(stream))
.unwrap() .unwrap()
.into_response(), .into_response(),
Err(_) => Response::builder() Err(_) => Response::builder()
src/interfaces/api/handlers/webdav_handler.rs
+13 -15
View File
@@ -936,7 +936,7 @@ async fn handle_copy(
// Get services from state // Get services from state
let file_retrieval_service = &state.applications.file_retrieval_service; let file_retrieval_service = &state.applications.file_retrieval_service;
let file_upload_service = &state.applications.file_upload_service; let _file_upload_service = &state.applications.file_upload_service;
let folder_service = &state.applications.folder_service; let folder_service = &state.applications.folder_service;
// Check if destination already exists (for Overwrite header compliance) // Check if destination already exists (for Overwrite header compliance)
@@ -996,26 +996,24 @@ async fn handle_copy(
})?; })?;
if recursive { if recursive {
// Copy subfolders and files (simplified implementation) // Copy files via zero-copy dedup (only increments blob ref_count)
let files = file_retrieval_service let files = file_retrieval_service
.list_files(Some(&folder.id)) .list_files(Some(&folder.id))
.await .await
.map_err(|e| AppError::internal_error(format!("Failed to list files: {}", e)))?; .map_err(|e| AppError::internal_error(format!("Failed to list files: {}", e)))?;
let file_management_service = &state.applications.file_management_service;
let new_folder_id = Some(_new_folder.id.clone());
for file in files { for file in files {
// Get file content file_management_service
if let Ok(content) = file_retrieval_service.get_file_content(&file.id).await { .copy_file(&file.id, new_folder_id.clone())
// Create new file in destination .await
file_upload_service .map_err(|e| {
.create_file(&destination_path, &file.name, &content, &file.mime_type) AppError::internal_error(format!(
.await "Failed to copy file {}: {}",
.map_err(|e| { file.name, e
AppError::internal_error(format!( ))
"Failed to copy file {}: {}", })?;
file.name, e
))
})?;
}
} }
} }
} else { } else {
src/interfaces/api/handlers/wopi_handler.rs
+8 -2
View File
@@ -117,6 +117,9 @@ async fn check_file_info(
} }
/// GET /wopi/files/{file_id}/contents — GetFile /// GET /wopi/files/{file_id}/contents — GetFile
///
/// Streams the file content to Collabora/OnlyOffice in 64 KB chunks.
/// Memory usage is constant (~64 KB) regardless of file size.
async fn get_file( async fn get_file(
Path(file_id): Path<String>, Path(file_id): Path<String>,
Query(token_query): Query<WopiTokenQuery>, Query(token_query): Query<WopiTokenQuery>,
@@ -138,10 +141,13 @@ async fn get_file(
.app_state .app_state
.applications .applications
.file_retrieval_service .file_retrieval_service
.get_file_content(&file_id) .get_file_stream(&file_id)
.await .await
{ {
Ok(content) => (StatusCode::OK, content).into_response(), Ok(stream) => {
let body = axum::body::Body::from_stream(std::pin::Pin::from(stream));
(StatusCode::OK, body).into_response()
}
Err(_) => StatusCode::NOT_FOUND.into_response(), Err(_) => StatusCode::NOT_FOUND.into_response(),
} }
} }