alvaro/normogen
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

fix(backend): refresh-token jti + code cleanup (#15,#28,#29,#30)

Browse source 
Refresh-token rotation bug (found via Solaria smoke test):
* RefreshClaims now carries a unique random jti (UUID v4). Without it, two
  refresh tokens issued in the same second (e.g. on rotation) were byte-identical
  — breaking rotation, colliding on the tokenHash unique index, and making a
  stolen old token indistinguishable from the new one. Every refresh token is
  now unique regardless of issue time. Added a unit test asserting consecutive
  tokens differ.

Code cleanup (review items):
* #15: removed unused deps tower_governor, slog, thiserror (zero refs in src/).
* #30: deleted leftover src/main.rs.restore (a stale git-error-message backup).
* #28: removed the 9 single-line-comment stub files under src/db/ (appointment,
  family, health_data, lab_result, medication, profile, permission, share, user)
  and their mod declarations; nothing referenced them, real logic lives in
  mongodb_impl.rs/init.rs.
* #29: stripped 61 broad module-level #![allow(...)] suppressions across src/.
  Fixed the surfaced warnings instead: 4 unused 'claims' extractor bindings ->
  _claims; removed dead OpenFDAService.client/base_url fields + the never-called
  query_drug_events method + unused HashMap/reqwest imports; applied clippy's
  mechanical fixes (Ok(?) -> ?, Copy ObjectId clone, redundant closures,
  useless conversions); rewrote 'if let Ok(_) = x' -> 'if x.is_ok()'. Result:
  cargo build + clippy --all-targets are warning-free with no blanket allows.

Verified: fmt clean, build clean, clippy 0 warnings, 19 unit tests pass
(was 18; +1 jti-uniqueness test).
This commit is contained in:
goose 2026-06-27 20:57:24 -03:00
parent e9f524671f
commit cf6fcd4ef2
45 changed files with 54 additions and 297 deletions
Download patch file Download diff file Expand all files Collapse all files

11
backend/src/handlers/medications.rs
View file

@ -1,6 +1,3 @@
#![allow(dead_code)]
#![allow(unused_imports)]
#![allow(unused_variables)]
use axum::{
extract::{Extension, Json, Path, Query, State},
http::StatusCode,
@ -103,7 +100,7 @@ pub async fn list_medications(
pub async fn get_medication(
State(state): State<AppState>,
Extension(claims): Extension<Claims>,
Extension(_claims): Extension<Claims>,
Path(id): Path<String>,
) -> Result<Json<Medication>, StatusCode> {
let database = state.db.get_database();
@ -121,7 +118,7 @@ pub async fn get_medication(
pub async fn update_medication(
State(state): State<AppState>,
Extension(claims): Extension<Claims>,
Extension(_claims): Extension<Claims>,
Path(id): Path<String>,
Json(req): Json<UpdateMedicationRequest>,
) -> Result<Json<Medication>, StatusCode> {
@ -140,7 +137,7 @@ pub async fn update_medication(
pub async fn delete_medication(
State(state): State<AppState>,
Extension(claims): Extension<Claims>,
Extension(_claims): Extension<Claims>,
Path(id): Path<String>,
) -> Result<StatusCode, StatusCode> {
let database = state.db.get_database();
@ -188,7 +185,7 @@ pub async fn log_dose(
pub async fn get_adherence(
State(state): State<AppState>,
Extension(claims): Extension<Claims>,
Extension(_claims): Extension<Claims>,
Path(id): Path<String>,
) -> Result<Json<crate::models::medication::AdherenceStats>, StatusCode> {
let database = state.db.get_database();