Commit Graph

4 Commits

Author SHA1 Message Date
zjean a7de63d80f fix: resolve clippy warnings (unused mut, from_str, result_large_err)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 20:47:09 +01:00
Diocrafts ee86c3a128 fix: resolve all clippy warnings and convert integration_tests to custom cfg
- Add type aliases (FileRow, FolderRow, FolderRowPaginated, FolderRowOptUser) to reduce type complexity
- Simplify redundant closures in app_password_handler and webdav_handler
- Remove needless borrow in auth_handler
- Collapse nested if/let chains in login_lockout, webdav_lock, auth, rate_limit
- Box LockEntry in acquire() Err variant to fix large enum variant warning
- Rename DeviceCodeStatus::from_str to parse to avoid should_implement_trait lint
- Add #[allow(clippy::too_many_arguments)] and #[allow(clippy::result_unit_err)] where appropriate
- Convert integration_tests from cargo feature to custom cfg attribute
- Add check-cfg lint config in Cargo.toml for integration_tests cfg
2026-03-04 23:55:08 +01:00
Diocrafts b81b7f7a0e fix: eliminate all 420 compiler warnings
- Add allow(async_fn_in_trait) in lib.rs for async trait methods
- Add integration_tests feature to Cargo.toml for cfg gating
- Gate trash_service_test module with cfg(feature = integration_tests)
- Remove unused MockFileWritePort from idor_protection_test.rs
2026-03-04 23:29:20 +01:00
Dionisio 4a60fdc984 fix(security): IDOR protection for file operations
Adds ownership verification at repository, service, and handler layers
for download, rename, move, and delete file operations.

- Repository: get_file_for_owner() with AND user_id= SQL filter
- Service: _owned() methods with verify_owner() fail-closed guard
- Handlers: require AuthUser, delegate to _owned() methods
- Tests: 10 IDOR protection tests (all passing)
- Cleanup: remove dead OptionalUserId import, gate broken pre-existing
  test modules behind integration_tests feature flag
2026-03-04 17:18:39 +01:00