cf6fcd4ef2
Refresh-token rotation bug (found via Solaria smoke test): * RefreshClaims now carries a unique random jti (UUID v4). Without it, two refresh tokens issued in the same second (e.g. on rotation) were byte-identical — breaking rotation, colliding on the tokenHash unique index, and making a stolen old token indistinguishable from the new one. Every refresh token is now unique regardless of issue time. Added a unit test asserting consecutive tokens differ. Code cleanup (review items): * #15: removed unused deps tower_governor, slog, thiserror (zero refs in src/). * #30: deleted leftover src/main.rs.restore (a stale git-error-message backup). * #28: removed the 9 single-line-comment stub files under src/db/ (appointment, family, health_data, lab_result, medication, profile, permission, share, user) and their mod declarations; nothing referenced them, real logic lives in mongodb_impl.rs/init.rs. * #29: stripped 61 broad module-level #![allow(...)] suppressions across src/. Fixed the surfaced warnings instead: 4 unused 'claims' extractor bindings -> _claims; removed dead OpenFDAService.client/base_url fields + the never-called query_drug_events method + unused HashMap/reqwest imports; applied clippy's mechanical fixes (Ok(?) -> ?, Copy ObjectId clone, redundant closures, useless conversions); rewrote 'if let Ok(_) = x' -> 'if x.is_ok()'. Result: cargo build + clippy --all-targets are warning-free with no blanket allows. Verified: fmt clean, build clean, clippy 0 warnings, 19 unit tests pass (was 18; +1 jti-uniqueness test).
117 lines
3.1 KiB
Rust
117 lines
3.1 KiB
Rust
use anyhow::Result;
|
|
use futures::stream::TryStreamExt;
|
|
use mongodb::{
|
|
bson::{doc, oid::ObjectId},
|
|
Collection,
|
|
};
|
|
use serde::{Deserialize, Serialize};
|
|
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
pub enum AuditEventType {
|
|
#[serde(rename = "login_success")]
|
|
LoginSuccess,
|
|
#[serde(rename = "login_failed")]
|
|
LoginFailed,
|
|
#[serde(rename = "logout")]
|
|
Logout,
|
|
#[serde(rename = "password_recovery")]
|
|
PasswordRecovery,
|
|
#[serde(rename = "password_changed")]
|
|
PasswordChanged,
|
|
#[serde(rename = "account_created")]
|
|
AccountCreated,
|
|
#[serde(rename = "account_deleted")]
|
|
AccountDeleted,
|
|
#[serde(rename = "data_accessed")]
|
|
DataAccessed,
|
|
#[serde(rename = "data_modified")]
|
|
DataModified,
|
|
#[serde(rename = "data_shared")]
|
|
DataShared,
|
|
#[serde(rename = "session_created")]
|
|
SessionCreated,
|
|
#[serde(rename = "session_revoked")]
|
|
SessionRevoked,
|
|
}
|
|
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
pub struct AuditLog {
|
|
#[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
|
|
pub id: Option<ObjectId>,
|
|
pub event_type: AuditEventType,
|
|
pub user_id: Option<ObjectId>,
|
|
pub email: Option<String>,
|
|
pub ip_address: String,
|
|
pub resource_type: Option<String>,
|
|
pub resource_id: Option<String>,
|
|
pub timestamp: mongodb::bson::DateTime,
|
|
}
|
|
|
|
#[derive(Clone)]
|
|
pub struct AuditLogRepository {
|
|
collection: Collection<AuditLog>,
|
|
}
|
|
|
|
impl AuditLogRepository {
|
|
pub fn new(db: &mongodb::Database) -> Self {
|
|
let collection = db.collection("audit_logs");
|
|
Self { collection }
|
|
}
|
|
|
|
pub async fn log(
|
|
&self,
|
|
event_type: AuditEventType,
|
|
user_id: Option<ObjectId>,
|
|
email: Option<String>,
|
|
ip_address: String,
|
|
resource_type: Option<String>,
|
|
resource_id: Option<String>,
|
|
) -> Result<ObjectId> {
|
|
let audit_log = AuditLog {
|
|
id: None,
|
|
event_type,
|
|
user_id,
|
|
email,
|
|
ip_address,
|
|
resource_type,
|
|
resource_id,
|
|
timestamp: mongodb::bson::DateTime::now(),
|
|
};
|
|
|
|
self.collection
|
|
.insert_one(audit_log, None)
|
|
.await?
|
|
.inserted_id
|
|
.as_object_id()
|
|
.ok_or_else(|| anyhow::anyhow!("Failed to get inserted id"))
|
|
}
|
|
|
|
pub async fn find_by_user(&self, user_id: &ObjectId) -> Result<Vec<AuditLog>> {
|
|
let cursor = self
|
|
.collection
|
|
.find(
|
|
doc! {
|
|
"user_id": user_id
|
|
},
|
|
None,
|
|
)
|
|
.await?;
|
|
|
|
let logs: Vec<AuditLog> = cursor.try_collect().await?;
|
|
Ok(logs)
|
|
}
|
|
|
|
pub async fn find_recent(&self, limit: u64) -> Result<Vec<AuditLog>> {
|
|
use mongodb::options::FindOptions;
|
|
|
|
let opts = FindOptions::builder()
|
|
.sort(doc! { "timestamp": -1 })
|
|
.limit(limit as i64)
|
|
.build();
|
|
|
|
let cursor = self.collection.find(doc! {}, opts).await?;
|
|
|
|
let logs: Vec<AuditLog> = cursor.try_collect().await?;
|
|
Ok(logs)
|
|
}
|
|
}
|