4 Commits

Author	SHA1	Message	Date
Diocrafts	06ed0455ce	perf: migrate all user/session/auth IDs from VARCHAR(36) to native UUID ... - Schema: all ~15 VARCHAR(36) columns → UUID with DEFAULT gen_random_uuid() - Domain entities: User, Session, DeviceCode, AppPassword, Share → id: Uuid - DTOs: CurrentUser.id → Uuid (API boundary DTOs keep String for JSON) - Auth middleware: parse JWT claims.sub (String) → Uuid at boundary - All repository traits, port traits, service impls updated end-to-end - Handlers: pass Uuid by value (Copy, 16 bytes) instead of String refs - Settings chain: updated_by column → Uuid (was text, caused setup crash) - Removed ~650 lines of String↔Uuid conversion boilerplate - Eliminates per-request heap allocations for ID cloning - 16-byte binary comparison vs 36-byte string comparison in all queries - Native UUID indexing in PostgreSQL (btree on 16 bytes vs 36-char text) 85 files changed, 1090 insertions(+), 1739 deletions(-)	2026-03-07 14:59:32 +01:00
Dionisio	f2d35ca792	feat: auto-persist JWT secret, remove setup token requirement ... - JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret - Remove setup token: first admin setup is open until system initialized - Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top - Update login UI and auth.js to remove setup token fields	2026-03-05 22:12:53 +01:00
Diocrafts	ee86c3a128	fix: resolve all clippy warnings and convert integration_tests to custom cfg ... - Add type aliases (FileRow, FolderRow, FolderRowPaginated, FolderRowOptUser) to reduce type complexity - Simplify redundant closures in app_password_handler and webdav_handler - Remove needless borrow in auth_handler - Collapse nested if/let chains in login_lockout, webdav_lock, auth, rate_limit - Box LockEntry in acquire() Err variant to fix large enum variant warning - Rename DeviceCodeStatus::from_str to parse to avoid should_implement_trait lint - Add #[allow(clippy::too_many_arguments)] and #[allow(clippy::result_unit_err)] where appropriate - Convert integration_tests from cargo feature to custom cfg attribute - Add check-cfg lint config in Cargo.toml for integration_tests cfg	2026-03-04 23:55:08 +01:00
Dionisio	81987e9321	fix: URL-decode DAV paths with spaces + feat: app passwords for Basic Auth ... Bug fix: - URL-decode paths in extract_webdav_path(), extract_caldav_path(), extract_carddav_path() so folders with spaces (e.g. 'My Folder') no longer return 404 when accessed via encoded URIs (%20) - Properly encode href values in PROPFIND/PROPPATCH/LOCK XML responses - Decode Destination header in MOVE/COPY operations New feature - App Passwords (API keys for DAV clients): - POST /api/auth/app-passwords → create (shows token once) - GET /api/auth/app-passwords → list (prefix only) - DELETE /api/auth/app-passwords/:id → revoke - Auth middleware now accepts both Bearer JWT and Basic Auth - Argon2 hashed, scoped (webdav/caldav/carddav), optional expiry - Compatible with DAVx5, Thunderbird, rclone, curl Tested: 12/12 E2E tests pass (create, list, WebDAV/CalDAV/CardDAV Basic Auth, URL-decode with spaces, wrong password 401, revoke, post- revoke 401).	2026-03-01 20:34:12 +01:00