alvaro/normogen
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

fix(backend): refresh-token jti + code cleanup (#15,#28,#29,#30)

Browse source 
Refresh-token rotation bug (found via Solaria smoke test):
* RefreshClaims now carries a unique random jti (UUID v4). Without it, two
  refresh tokens issued in the same second (e.g. on rotation) were byte-identical
  — breaking rotation, colliding on the tokenHash unique index, and making a
  stolen old token indistinguishable from the new one. Every refresh token is
  now unique regardless of issue time. Added a unit test asserting consecutive
  tokens differ.

Code cleanup (review items):
* #15: removed unused deps tower_governor, slog, thiserror (zero refs in src/).
* #30: deleted leftover src/main.rs.restore (a stale git-error-message backup).
* #28: removed the 9 single-line-comment stub files under src/db/ (appointment,
  family, health_data, lab_result, medication, profile, permission, share, user)
  and their mod declarations; nothing referenced them, real logic lives in
  mongodb_impl.rs/init.rs.
* #29: stripped 61 broad module-level #![allow(...)] suppressions across src/.
  Fixed the surfaced warnings instead: 4 unused 'claims' extractor bindings ->
  _claims; removed dead OpenFDAService.client/base_url fields + the never-called
  query_drug_events method + unused HashMap/reqwest imports; applied clippy's
  mechanical fixes (Ok(?) -> ?, Copy ObjectId clone, redundant closures,
  useless conversions); rewrote 'if let Ok(_) = x' -> 'if x.is_ok()'. Result:
  cargo build + clippy --all-targets are warning-free with no blanket allows.

Verified: fmt clean, build clean, clippy 0 warnings, 19 unit tests pass
(was 18; +1 jti-uniqueness test).
This commit is contained in:
goose 2026-06-27 20:57:24 -03:00
parent e9f524671f
commit cf6fcd4ef2
45 changed files with 54 additions and 297 deletions
Download patch file Download diff file Expand all files Collapse all files

3
backend/Cargo.toml
View file

@ -8,7 +8,6 @@ axum = "0.7.9"
tokio = { version = "1.41.1", features = ["full"] }
tower = { version = "0.4.13", features = ["util"] }
tower-http = { version = "0.5.2", features = ["cors", "trace"] }
tower_governor = "0.4.3"
serde = { version = "1.0.215", features = ["derive"] }
serde_json = "1.0.133"
mongodb = "2.8.2"
@ -23,11 +22,9 @@ password-hash = "0.5.0"
rand = "0.8.5"
base64 = "0.22.1"
sha2 = "0.10"
thiserror = "1.0.69"
anyhow = "1.0.94"
tracing = "0.1.41"
tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
slog = "2.7.0"
strum = { version = "0.26", features = ["derive"] }
strum_macros = "0.26"
futures = "0.3"