alvaro/normogen

Fork 0

code: remove dead AccessClaims struct in backend/src/auth/claims.rs #5

New issue

Closed

opened 2026-07-18 22:22:58 +00:00 by alvaro · 1 comment

alvaro commented

2026-07-18 22:22:58 +00:00

Owner

Stale/dead code: `backend/src/auth/claims.rs` (`AccessClaims`)

Found while reconciling docs in #4.

backend/src/auth/claims.rs defines:

pub struct AccessClaims {
    pub sub: String,
    pub email: String,
    pub family_id: Option<String>,
    pub permissions: Vec<String>,
    pub token_type: String,
    pub iat: i64,
    pub exp: i64,
    pub jti: String,
}

This struct is not imported or used anywhere in the backend source (it appears only in stale compiler scratch files under target/). The real access-token claims are Claims in backend/src/auth/jwt.rs:

pub struct Claims {            // actually used
    pub sub: String,
    pub exp: usize,
    pub iat: usize,
    pub user_id: String,
    pub email: String,
    pub token_version: i32,
}

No family_id, no permissions, no token_type, no jti on access tokens.

Why it matters

It's a latent trap: someone could wire up AccessClaims assuming the family_id / permissions fields are populated and enforced, when in fact no such protection exists. It also misled the earlier doc review (see the correction comment on #3).

Fix options

Delete the file if it's purely aspirational dead code. Simplest.
Or leave a one-line comment marking it unused, to be wired up intentionally when #3 (multi-person sharing) lands.

My recommendation: delete now. If family/permission claims are needed later they should be designed against the actual sharing model from the #3 ADR, not this stub.

Labels: bug, docs.

## Stale/dead code: `backend/src/auth/claims.rs` (`AccessClaims`) Found while reconciling docs in #4. `backend/src/auth/claims.rs` defines: ```rust pub struct AccessClaims { pub sub: String, pub email: String, pub family_id: Option<String>, pub permissions: Vec<String>, pub token_type: String, pub iat: i64, pub exp: i64, pub jti: String, } ``` This struct is **not imported or used anywhere** in the backend source (it appears only in stale compiler scratch files under `target/`). The real access-token claims are `Claims` in `backend/src/auth/jwt.rs`: ```rust pub struct Claims { // actually used pub sub: String, pub exp: usize, pub iat: usize, pub user_id: String, pub email: String, pub token_version: i32, } ``` No `family_id`, no `permissions`, no `token_type`, no `jti` on access tokens. ### Why it matters It's a latent trap: someone could wire up `AccessClaims` assuming the `family_id` / `permissions` fields are populated and enforced, when in fact no such protection exists. It also misled the earlier doc review (see the correction comment on #3). ### Fix options - **Delete the file** if it's purely aspirational dead code. Simplest. - **Or** leave a one-line comment marking it unused, to be wired up intentionally when #3 (multi-person sharing) lands. My recommendation: delete now. If family/permission claims are needed later they should be designed against the actual sharing model from the #3 ADR, not this stub. Labels: `bug`, `docs`.

alvaro added the

bug

docs

labels 2026-07-18 22:22:58 +00:00

alvaro referenced this issue

2026-07-18 22:24:37 +00:00

design: multi-person / family / caregiver data sharing under zero-knowledge encryption is unsolved #3

alvaro referenced this issue

2026-07-18 23:00:24 +00:00

feat(auth): per-account X25519 identity keypair (Phase A1, #3) #6

alvaro referenced this issue

2026-07-19 02:45:44 +00:00

feat: per-profile DEKs + multi-profile (Phase A2, #3) #9

alvaro referenced this issue

2026-07-19 10:21:44 +00:00

feat: profile sharing via X25519 envelope (Phase B, #3) #11

alvaro referenced this issue

2026-07-19 10:22:11 +00:00

design: multi-person / family / caregiver data sharing under zero-knowledge encryption is unsolved #3

alvaro referenced this issue

2026-07-19 14:53:01 +00:00

design: multi-person / family / caregiver data sharing under zero-knowledge encryption is unsolved #3

alvaro referenced this issue from a commit

2026-07-19 15:23:32 +00:00

chore: remove dead AccessClaims struct (#5)

alvaro referenced this issue from a pull request that will close it,

2026-07-19 15:24:01 +00:00

chore: remove dead AccessClaims struct (#5) #14

alvaro closed this issue

2026-07-20 01:09:31 +00:00

alvaro commented

2026-07-20 01:15:33 +00:00

Author

Owner

Closed via PR #14 (merged). backend/src/auth/claims.rs is deleted; the JWT ADR's open item is marked done. The live Claims/RefreshClaims in backend/src/auth/jwt.rs are the only definitions.

Closed via PR #14 (merged). `backend/src/auth/claims.rs` is deleted; the JWT ADR's open item is marked done. The live `Claims`/`RefreshClaims` in `backend/src/auth/jwt.rs` are the only definitions.