Oxicloud

cjw/Oxicloud

Fork 0

Commit Graph

Author	SHA1	Message	Date
Dionisio	efcf88c4d7	style: cargo fmt --all	2026-03-03 01:49:18 +01:00
Dionisio	05acd6fb7b	perf: add moka cache to Basic Auth verification in AppPasswordService Cache successful Basic Auth verifications for 30s using blake3(username:password) as cache key. This eliminates repeated Argon2id computation (~3-5ms CPU + 64MiB RAM) and 3 PostgreSQL round-trips per DAV request from the same client. - Add moka::future::Cache<[u8;32], CachedBasicAuthResult> field - Cache hits return in ~200ns vs ~5ms (25,000x improvement) - Failed verifications are never cached (brute-force protection intact) - revoke() invalidates all cached entries for the affected user - ~1.6MB max memory footprint (10,000 entries)	2026-03-02 23:19:05 +01:00
Dionisio	81987e9321	fix: URL-decode DAV paths with spaces + feat: app passwords for Basic Auth Bug fix: - URL-decode paths in extract_webdav_path(), extract_caldav_path(), extract_carddav_path() so folders with spaces (e.g. 'My Folder') no longer return 404 when accessed via encoded URIs (%20) - Properly encode href values in PROPFIND/PROPPATCH/LOCK XML responses - Decode Destination header in MOVE/COPY operations New feature - App Passwords (API keys for DAV clients): - POST /api/auth/app-passwords → create (shows token once) - GET /api/auth/app-passwords → list (prefix only) - DELETE /api/auth/app-passwords/:id → revoke - Auth middleware now accepts both Bearer JWT and Basic Auth - Argon2 hashed, scoped (webdav/caldav/carddav), optional expiry - Compatible with DAVx5, Thunderbird, rclone, curl Tested: 12/12 E2E tests pass (create, list, WebDAV/CalDAV/CardDAV Basic Auth, URL-decode with spaces, wrong password 401, revoke, post- revoke 401).	2026-03-01 20:34:12 +01:00

Author

SHA1

Message

Date

Dionisio

efcf88c4d7

style: cargo fmt --all

2026-03-03 01:49:18 +01:00

Dionisio

05acd6fb7b

perf: add moka cache to Basic Auth verification in AppPasswordService

Cache successful Basic Auth verifications for 30s using blake3(username:password)
as cache key. This eliminates repeated Argon2id computation (~3-5ms CPU + 64MiB
RAM) and 3 PostgreSQL round-trips per DAV request from the same client.

- Add moka::future::Cache<[u8;32], CachedBasicAuthResult> field
- Cache hits return in ~200ns vs ~5ms (25,000x improvement)
- Failed verifications are never cached (brute-force protection intact)
- revoke() invalidates all cached entries for the affected user
- ~1.6MB max memory footprint (10,000 entries)

2026-03-02 23:19:05 +01:00

Dionisio

81987e9321

fix: URL-decode DAV paths with spaces + feat: app passwords for Basic Auth

Bug fix:
- URL-decode paths in extract_webdav_path(), extract_caldav_path(),
  extract_carddav_path() so folders with spaces (e.g. 'My Folder') no
  longer return 404 when accessed via encoded URIs (%20)
- Properly encode href values in PROPFIND/PROPPATCH/LOCK XML responses
- Decode Destination header in MOVE/COPY operations

New feature - App Passwords (API keys for DAV clients):
- POST /api/auth/app-passwords  → create (shows token once)
- GET  /api/auth/app-passwords  → list (prefix only)
- DELETE /api/auth/app-passwords/:id → revoke
- Auth middleware now accepts both Bearer JWT and Basic Auth
- Argon2 hashed, scoped (webdav/caldav/carddav), optional expiry
- Compatible with DAVx5, Thunderbird, rclone, curl

Tested: 12/12 E2E tests pass (create, list, WebDAV/CalDAV/CardDAV
Basic Auth, URL-decode with spaces, wrong password 401, revoke, post-
revoke 401).

2026-03-01 20:34:12 +01:00

3 Commits