Diocrafts
06ed0455ce
- Schema: all ~15 VARCHAR(36) columns → UUID with DEFAULT gen_random_uuid() - Domain entities: User, Session, DeviceCode, AppPassword, Share → id: Uuid - DTOs: CurrentUser.id → Uuid (API boundary DTOs keep String for JSON) - Auth middleware: parse JWT claims.sub (String) → Uuid at boundary - All repository traits, port traits, service impls updated end-to-end - Handlers: pass Uuid by value (Copy, 16 bytes) instead of String refs - Settings chain: updated_by column → Uuid (was text, caused setup crash) - Removed ~650 lines of String↔Uuid conversion boilerplate - Eliminates per-request heap allocations for ID cloning - 16-byte binary comparison vs 36-byte string comparison in all queries - Native UUID indexing in PostgreSQL (btree on 16 bytes vs 36-char text) 85 files changed, 1090 insertions(+), 1739 deletions(-)
84 lines
2.6 KiB
Rust
Executable File
84 lines
2.6 KiB
Rust
Executable File
//! App Password entity.
|
|
//!
|
|
//! Represents an application-specific password that clients (like DAVx⁵, Thunderbird)
|
|
//! can use with HTTP Basic Auth to access WebDAV/CalDAV/CardDAV endpoints without
|
|
//! requiring interactive OAuth flows.
|
|
|
|
use chrono::{DateTime, Utc};
|
|
use uuid::Uuid;
|
|
|
|
/// An application password created by a user for a specific client.
|
|
#[derive(Debug, Clone)]
|
|
pub struct AppPassword {
|
|
/// Unique identifier.
|
|
pub id: Uuid,
|
|
/// Owner user ID.
|
|
pub user_id: Uuid,
|
|
/// Human-readable label chosen by the user (e.g. "DAVx5 on Pixel 8").
|
|
pub label: String,
|
|
/// Argon2 hash of the generated password token.
|
|
///
|
|
/// The plain text token is only returned once at creation time.
|
|
pub password_hash: String,
|
|
/// First 8 characters of the plain text token, stored for display purposes
|
|
/// so the user can identify which token is which.
|
|
pub prefix: String,
|
|
/// Comma-separated scopes (e.g. "webdav,caldav,carddav").
|
|
pub scopes: String,
|
|
/// When this app password was created.
|
|
pub created_at: DateTime<Utc>,
|
|
/// When this app password was last used for authentication.
|
|
pub last_used_at: Option<DateTime<Utc>>,
|
|
/// Optional expiry — `None` means never expires.
|
|
pub expires_at: Option<DateTime<Utc>>,
|
|
/// Whether this app password is active.
|
|
pub active: bool,
|
|
}
|
|
|
|
impl AppPassword {
|
|
/// Create a new app password entity.
|
|
///
|
|
/// The caller is responsible for hashing the raw token and passing
|
|
/// the hash and prefix.
|
|
pub fn new(
|
|
user_id: Uuid,
|
|
label: String,
|
|
password_hash: String,
|
|
prefix: String,
|
|
scopes: String,
|
|
expires_at: Option<DateTime<Utc>>,
|
|
) -> Self {
|
|
Self {
|
|
id: Uuid::new_v4(),
|
|
user_id,
|
|
label,
|
|
password_hash,
|
|
prefix,
|
|
scopes,
|
|
created_at: Utc::now(),
|
|
last_used_at: None,
|
|
expires_at,
|
|
active: true,
|
|
}
|
|
}
|
|
|
|
/// Check whether this app password has expired.
|
|
pub fn is_expired(&self) -> bool {
|
|
if let Some(exp) = self.expires_at {
|
|
Utc::now() >= exp
|
|
} else {
|
|
false
|
|
}
|
|
}
|
|
|
|
/// Check whether this app password is usable (active and not expired).
|
|
pub fn is_usable(&self) -> bool {
|
|
self.active && !self.is_expired()
|
|
}
|
|
|
|
/// Check whether the given scope is granted by this app password.
|
|
pub fn has_scope(&self, scope: &str) -> bool {
|
|
self.scopes.split(',').any(|s| s.trim() == scope)
|
|
}
|
|
}
|