cf6fcd4ef2
Refresh-token rotation bug (found via Solaria smoke test): * RefreshClaims now carries a unique random jti (UUID v4). Without it, two refresh tokens issued in the same second (e.g. on rotation) were byte-identical — breaking rotation, colliding on the tokenHash unique index, and making a stolen old token indistinguishable from the new one. Every refresh token is now unique regardless of issue time. Added a unit test asserting consecutive tokens differ. Code cleanup (review items): * #15: removed unused deps tower_governor, slog, thiserror (zero refs in src/). * #30: deleted leftover src/main.rs.restore (a stale git-error-message backup). * #28: removed the 9 single-line-comment stub files under src/db/ (appointment, family, health_data, lab_result, medication, profile, permission, share, user) and their mod declarations; nothing referenced them, real logic lives in mongodb_impl.rs/init.rs. * #29: stripped 61 broad module-level #![allow(...)] suppressions across src/. Fixed the surfaced warnings instead: 4 unused 'claims' extractor bindings -> _claims; removed dead OpenFDAService.client/base_url fields + the never-called query_drug_events method + unused HashMap/reqwest imports; applied clippy's mechanical fixes (Ok(?) -> ?, Copy ObjectId clone, redundant closures, useless conversions); rewrote 'if let Ok(_) = x' -> 'if x.is_ok()'. Result: cargo build + clippy --all-targets are warning-free with no blanket allows. Verified: fmt clean, build clean, clippy 0 warnings, 19 unit tests pass (was 18; +1 jti-uniqueness test).
123 lines
3.3 KiB
Rust
123 lines
3.3 KiB
Rust
use mongodb::bson::DateTime;
|
|
use mongodb::bson::{doc, oid::ObjectId};
|
|
use mongodb::Collection;
|
|
use serde::{Deserialize, Serialize};
|
|
|
|
use super::permission::Permission;
|
|
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
pub struct Share {
|
|
#[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
|
|
pub id: Option<ObjectId>,
|
|
pub owner_id: ObjectId,
|
|
pub target_user_id: ObjectId,
|
|
pub resource_type: String,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
pub resource_id: Option<ObjectId>,
|
|
pub permissions: Vec<Permission>,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
pub expires_at: Option<DateTime>,
|
|
pub created_at: DateTime,
|
|
pub active: bool,
|
|
}
|
|
|
|
impl Share {
|
|
pub fn new(
|
|
owner_id: ObjectId,
|
|
target_user_id: ObjectId,
|
|
resource_type: String,
|
|
resource_id: Option<ObjectId>,
|
|
permissions: Vec<Permission>,
|
|
expires_at: Option<DateTime>,
|
|
) -> Self {
|
|
Self {
|
|
id: None,
|
|
owner_id,
|
|
target_user_id,
|
|
resource_type,
|
|
resource_id,
|
|
permissions,
|
|
expires_at,
|
|
created_at: DateTime::now(),
|
|
active: true,
|
|
}
|
|
}
|
|
|
|
pub fn is_expired(&self) -> bool {
|
|
if let Some(expires) = self.expires_at {
|
|
DateTime::now() > expires
|
|
} else {
|
|
false
|
|
}
|
|
}
|
|
|
|
pub fn has_permission(&self, permission: &Permission) -> bool {
|
|
self.permissions.contains(permission) || self.permissions.contains(&Permission::Admin)
|
|
}
|
|
|
|
pub fn revoke(&mut self) {
|
|
self.active = false;
|
|
}
|
|
}
|
|
|
|
#[derive(Clone)]
|
|
pub struct ShareRepository {
|
|
collection: Collection<Share>,
|
|
}
|
|
|
|
impl ShareRepository {
|
|
pub fn new(collection: Collection<Share>) -> Self {
|
|
Self { collection }
|
|
}
|
|
|
|
pub async fn create(&self, share: &Share) -> mongodb::error::Result<Option<ObjectId>> {
|
|
let result = self.collection.insert_one(share, None).await?;
|
|
Ok(Some(result.inserted_id.as_object_id().unwrap()))
|
|
}
|
|
|
|
pub async fn find_by_id(&self, id: &ObjectId) -> mongodb::error::Result<Option<Share>> {
|
|
self.collection.find_one(doc! { "_id": id }, None).await
|
|
}
|
|
|
|
pub async fn find_by_owner(&self, owner_id: &ObjectId) -> mongodb::error::Result<Vec<Share>> {
|
|
use futures::stream::TryStreamExt;
|
|
|
|
self.collection
|
|
.find(doc! { "owner_id": owner_id }, None)
|
|
.await?
|
|
.try_collect()
|
|
.await
|
|
}
|
|
|
|
pub async fn find_by_target(
|
|
&self,
|
|
target_user_id: &ObjectId,
|
|
) -> mongodb::error::Result<Vec<Share>> {
|
|
use futures::stream::TryStreamExt;
|
|
|
|
self.collection
|
|
.find(
|
|
doc! { "target_user_id": target_user_id, "active": true },
|
|
None,
|
|
)
|
|
.await?
|
|
.try_collect()
|
|
.await
|
|
}
|
|
|
|
pub async fn update(&self, share: &Share) -> mongodb::error::Result<()> {
|
|
if let Some(id) = &share.id {
|
|
self.collection
|
|
.replace_one(doc! { "_id": id }, share, None)
|
|
.await?;
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn delete(&self, share_id: &ObjectId) -> mongodb::error::Result<()> {
|
|
self.collection
|
|
.delete_one(doc! { "_id": share_id }, None)
|
|
.await?;
|
|
Ok(())
|
|
}
|
|
}
|