bd1b7c2925
P1 items #6 (JWT expiry) and #7 (refresh/logout routes) were already delivered in the P0 pass. This commit covers the two remaining P1 items: #9 — Replace dangerous handler-level .unwrap() calls (13 sites): * handlers/users.rs: 5x ObjectId::parse_str(&claims.sub).unwrap() in get_profile/update_profile/delete_account/get_settings/update_settings now return 401 on a malformed subject instead of panicking (matches the guard already used in change_password). * handlers/auth.rs: the login user.id.ok_or_else(..).unwrap() was a latent panic bug — the crafted 500 response was discarded. Now returns the clean 500 via match. * handlers/health_stats.rs: 6x state.health_stats_repo.as_ref().unwrap() now return 503 SERVICE_UNAVAILABLE if the feature is unconfigured, mirroring the interactions.rs pattern. * Left untouched: 14 test/boot-time unwraps and 7 infallible ones (header literal parsing, infallible TryFrom). The 3 borderline model-layer inserted_id unwraps are flagged for later. #8 — Rewrite the broken integration tests against a real test DB: * Split the crate into bin+lib: new src/lib.rs + src/app.rs (build_app), with main.rs now a thin entrypoint. Tests build the exact production router in-process instead of hitting a live server on a hardcoded port. * tests/common/mod.rs: helpers that connect to Mongo, build a fresh AppState against a unique per-process DB (normogen_test_<uuid>), and tear it down. A 1s connectivity probe makes tests skip gracefully when Mongo is absent, so 'cargo test' stays green without Mongo — CI runs them for real. * Rewrote tests/auth_tests.rs and tests/medication_tests.rs with the ACTUAL API contracts (POST /register {email,username,password}; response has token + refresh_token, not access_token; register returns 201). Covers register, login (right/wrong password), auth enforcement, refresh rotation + reuse detection, logout, and password-change invalidating old tokens. * Added a 'test' CI job with a mongo:7 service container running cargo test --all-targets. * Synced scripts/test-ci-locally.sh: fixed the stale -D warnings (CI is non-strict) and the reverted 'Docker Buildx' claims; added unit + integration test steps with a Mongo skip note. Verified: cargo fmt --check clean, build + clippy --all-targets clean. Full 'cargo test': 18 unit + 9 auth + 4 medication = 31 passed, 0 failed (integration tests skip cleanly when MongoDB is unreachable).
33 lines
1,018 B
TOML
33 lines
1,018 B
TOML
[package]
|
|
name = "normogen-backend"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
|
|
[dependencies]
|
|
axum = "0.7.9"
|
|
tokio = { version = "1.41.1", features = ["full"] }
|
|
tower = { version = "0.4.13", features = ["util"] }
|
|
tower-http = { version = "0.5.2", features = ["cors", "trace"] }
|
|
tower_governor = "0.4.3"
|
|
serde = { version = "1.0.215", features = ["derive"] }
|
|
serde_json = "1.0.133"
|
|
mongodb = "2.8.2"
|
|
jsonwebtoken = "9.3.1"
|
|
chrono = { version = "0.4.38", features = ["serde"] }
|
|
dotenv = "0.15.0"
|
|
validator = { version = "0.16.1", features = ["derive"] }
|
|
uuid = { version = "1.11.0", features = ["v4", "serde"] }
|
|
reqwest = { version = "0.12.28", features = ["json"] }
|
|
pbkdf2 = { version = "0.12.2", features = ["simple"] }
|
|
password-hash = "0.5.0"
|
|
rand = "0.8.5"
|
|
base64 = "0.22.1"
|
|
sha2 = "0.10"
|
|
thiserror = "1.0.69"
|
|
anyhow = "1.0.94"
|
|
tracing = "0.1.41"
|
|
tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
|
|
slog = "2.7.0"
|
|
strum = { version = "0.26", features = ["derive"] }
|
|
strum_macros = "0.26"
|
|
futures = "0.3"
|