f2d35ca792
feat: auto-persist JWT secret, remove setup token requirement
...
- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields
2026-03-05 22:12:53 +01:00
190527edfb
style: apply rustfmt formatting to fix CI
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-05 21:28:51 +01:00
b503e08384
security: fix vulnerabilities 1-7 from security audit
...
- Fix #1 : Share handler IDOR - enforce owner check on share operations
- Fix #2 : list_files_query IDOR - bind folder queries to authenticated user
- Fix #3 : Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4 : Trash handler OptionalAuthUser - require full AuthUser
- Fix #5 : Error info leakage - sanitize 500 error responses
- Fix #6 : Chunked upload IDOR - bind upload sessions to user_id,
add verify_session_owner() check on all session operations
- Fix #7 : CSP unsafe-inline removal - migrate all inline scripts,
styles and event handlers to external files, tighten CSP to
script-src 'self'; style-src 'self'
New files:
- static/js/core/theme-init.js (render-blocking theme init)
- static/js/core/sw-register.js (service worker registration)
- static/css/views/device-verify.css (extracted inline styles)
- static/js/views/device-verify/device-verify.js (extracted inline script)
2026-03-05 13:15:34 +01:00
71c2cb5edb
perf: Arc<AppState>, streaming PROPFIND, spawn_blocking SHA-256
...
- Issue #4 : Wrap AppState in Arc — eliminates 42 Arc::clone + 16 String::clone per request
- Issue #2 : Reject Depth:infinity with 403 + streaming XML with paginated DB queries
- Issue #5 : Move chunked upload assembly (SHA-256 hash-on-write) to spawn_blocking
- Remove ~270 lines dead code from di.rs (unused builders, Default impl, stubs)
- Clean up unused tokio imports in chunked_upload_service.rs
2026-02-24 15:11:56 +01:00
85908311dc
perf: findings 6.1, 6.2, 2.6 — async Argon2, moka cache, full streaming migration
...
- 6.1: PasswordHasherPort now async_trait with spawn_blocking for Argon2
- 6.2: OIDC pending maps migrated from std::sync::Mutex to moka::sync::Cache with TTL
- 2.6: All file download paths migrated to 64KB streaming (get_file_stream / read_blob_stream)
- WOPI, dedup, batch ZIP, file_retrieval_service consumers migrated
- WebDAV COPY uses zero-copy dedup (copy_file)
- Removed dead code: get_file_content, get_file_mmap, read_blob, read_blob_bytes
from traits, impls, stubs, and mocks (18 files touched)
2026-02-23 00:51:46 +01:00
4c98c5a657
style: apply cargo fmt to entire codebase
...
Standardize code formatting across all 173 Rust source files
using rustfmt. No functional changes - purely cosmetic.
This establishes a consistent code style baseline for the
project going forward.
2026-02-14 01:29:34 +01:00
a82faa5eaf
refactoring hexagonal and clean architecture
2026-02-08 13:40:23 +01:00
8f2b0a354c
big refactoring
2026-02-03 17:59:04 +01:00
Dionisio