81f33458e0
perf: streaming hash-on-write dedup upload, remove dead code
2026-04-11 16:17:47 +02:00
badf35f08f
chore: remove all executable attributes on non bash files
2026-04-01 23:14:42 +02:00
18518bedaf
fix: resolve clippy warnings and rustfmt issues for CI compliance
...
Fix all clippy lints (collapsible if, clone on Copy, needless borrow,
redundant bindings, unused params) and apply rustfmt across the codebase.
Update test mocks to match Uuid-based trait signatures.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-09 14:34:07 +01:00
06ed0455ce
perf: migrate all user/session/auth IDs from VARCHAR(36) to native UUID
...
- Schema: all ~15 VARCHAR(36) columns → UUID with DEFAULT gen_random_uuid()
- Domain entities: User, Session, DeviceCode, AppPassword, Share → id: Uuid
- DTOs: CurrentUser.id → Uuid (API boundary DTOs keep String for JSON)
- Auth middleware: parse JWT claims.sub (String) → Uuid at boundary
- All repository traits, port traits, service impls updated end-to-end
- Handlers: pass Uuid by value (Copy, 16 bytes) instead of String refs
- Settings chain: updated_by column → Uuid (was text, caused setup crash)
- Removed ~650 lines of String↔Uuid conversion boilerplate
- Eliminates per-request heap allocations for ID cloning
- 16-byte binary comparison vs 36-byte string comparison in all queries
- Native UUID indexing in PostgreSQL (btree on 16 bytes vs 36-char text)
85 files changed, 1090 insertions(+), 1739 deletions(-)
2026-03-07 14:59:32 +01:00
9aa35aa0ea
quick fix
2026-03-06 13:18:36 +01:00
f2d35ca792
feat: auto-persist JWT secret, remove setup token requirement
...
- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields
2026-03-05 22:12:53 +01:00
190527edfb
style: apply rustfmt formatting to fix CI
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-05 21:28:51 +01:00
b503e08384
security: fix vulnerabilities 1-7 from security audit
...
- Fix #1 : Share handler IDOR - enforce owner check on share operations
- Fix #2 : list_files_query IDOR - bind folder queries to authenticated user
- Fix #3 : Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4 : Trash handler OptionalAuthUser - require full AuthUser
- Fix #5 : Error info leakage - sanitize 500 error responses
- Fix #6 : Chunked upload IDOR - bind upload sessions to user_id,
add verify_session_owner() check on all session operations
- Fix #7 : CSP unsafe-inline removal - migrate all inline scripts,
styles and event handlers to external files, tighten CSP to
script-src 'self'; style-src 'self'
New files:
- static/js/core/theme-init.js (render-blocking theme init)
- static/js/core/sw-register.js (service worker registration)
- static/css/views/device-verify.css (extracted inline styles)
- static/js/views/device-verify/device-verify.js (extracted inline script)
2026-03-05 13:15:34 +01:00
71c2cb5edb
perf: Arc<AppState>, streaming PROPFIND, spawn_blocking SHA-256
...
- Issue #4 : Wrap AppState in Arc — eliminates 42 Arc::clone + 16 String::clone per request
- Issue #2 : Reject Depth:infinity with 403 + streaming XML with paginated DB queries
- Issue #5 : Move chunked upload assembly (SHA-256 hash-on-write) to spawn_blocking
- Remove ~270 lines dead code from di.rs (unused builders, Default impl, stubs)
- Clean up unused tokio imports in chunked_upload_service.rs
2026-02-24 15:11:56 +01:00
85908311dc
perf: findings 6.1, 6.2, 2.6 — async Argon2, moka cache, full streaming migration
...
- 6.1: PasswordHasherPort now async_trait with spawn_blocking for Argon2
- 6.2: OIDC pending maps migrated from std::sync::Mutex to moka::sync::Cache with TTL
- 2.6: All file download paths migrated to 64KB streaming (get_file_stream / read_blob_stream)
- WOPI, dedup, batch ZIP, file_retrieval_service consumers migrated
- WebDAV COPY uses zero-copy dedup (copy_file)
- Removed dead code: get_file_content, get_file_mmap, read_blob, read_blob_bytes
from traits, impls, stubs, and mocks (18 files touched)
2026-02-23 00:51:46 +01:00
4c98c5a657
style: apply cargo fmt to entire codebase
...
Standardize code formatting across all 173 Rust source files
using rustfmt. No functional changes - purely cosmetic.
This establishes a consistent code style baseline for the
project going forward.
2026-02-14 01:29:34 +01:00
a82faa5eaf
refactoring hexagonal and clean architecture
2026-02-08 13:40:23 +01:00
8f2b0a354c
big refactoring
2026-02-03 17:59:04 +01:00
Diocrafts