webdav token regeneration

backend/src/auth/webdav_tokens.rs

@@ -74,6 +74,51 @@ pub fn list_webdav_tokens(
     Ok(tokens)
 }
 
+pub fn regenerate_webdav_token(
+    conn: &mut PgPooledConnection,
+    token_id: Uuid,
+    user_id: Uuid,
+    tenant_id: Option<Uuid>,
+) -> Result<IssuedWebdavToken, AppError> {
+    let mut query = webdav_tokens::table
+        .filter(webdav_tokens::id.eq(token_id))
+        .filter(webdav_tokens::user_id.eq(user_id))
+        .into_boxed();
+
+    if let Some(tenant) = tenant_id {
+        query = query.filter(webdav_tokens::tenant_id.eq(tenant));
+    }
+
+    let record = query
+        .first::<WebdavToken>(conn)
+        .optional()
+        .map_err(AppError::from)?
+        .ok_or_else(AppError::not_found)?;
+
+    if record.revoked_at.is_some() {
+        return Err(AppError::bad_request(
+            "cannot regenerate a revoked WebDAV token",
+        ));
+    }
+
+    let raw_secret = generate_secret()?;
+    let token_prefix = raw_secret[..TOKEN_PREFIX_LENGTH].to_string();
+    let token_hash = hash_secret(&raw_secret)?;
+
+    let updated = diesel::update(webdav_tokens::table.find(record.id))
+        .set((
+            webdav_tokens::token_prefix.eq(&token_prefix),
+            webdav_tokens::token_hash.eq(&token_hash),
+            webdav_tokens::last_used_at.eq::<Option<NaiveDateTime>>(None),
+        ))
+        .get_result::<WebdavToken>(conn)?;
+
+    Ok(IssuedWebdavToken {
+        token: raw_secret,
+        record: updated,
+    })
+}
+
 pub fn find_active_token_by_secret(
     conn: &mut PgPooledConnection,
     user_id: Uuid,

backend/src/routes/auth.rs

@@ -533,7 +533,10 @@ pub async fn list_tenants(
             .select(tenant_dsl::name)
             .first(&mut tenant_conn)
             .map_err(AppError::from)?;
-        tenants.push(TenantSnippet { id: tenant_id, name });
+        tenants.push(TenantSnippet {
+            id: tenant_id,
+            name,
+        });
     }
 
     Ok(Json(TenantListResponse { tenants }))
@@ -699,7 +702,10 @@ fn complete_login(
             .select(tenant_dsl::name)
             .first(&mut tenant_conn)
             .map_err(AppError::from)?;
-        tenants.push(TenantSnippet { id: tenant_id, name });
+        tenants.push(TenantSnippet {
+            id: tenant_id,
+            name,
+        });
     }
 
     Ok(Json(TenantSelectionResponse {

backend/src/routes/mod.rs

@@ -148,6 +148,10 @@ pub fn create_router(state: AppState) -> Router<()> {
             "/webdav-tokens",
             get(profile::list_webdav_tokens).post(profile::create_webdav_token),
         )
+        .route(
+            "/webdav-tokens/:id/regenerate",
+            post(profile::regenerate_webdav_token),
+        )
         .route("/webdav-tokens/:id", delete(profile::delete_webdav_token))
         .route("/passkeys", get(profile::list_passkeys))
         .route("/passkeys/:id", delete(profile::delete_passkey));

backend/src/routes/profile.rs

@@ -12,7 +12,7 @@ use crate::auth::{
     passkeys::PasskeySummary,
     webdav_tokens::{
         create_webdav_token as issue_token, list_webdav_tokens as load_tokens,
-        revoke_webdav_token as revoke_token,
+        regenerate_webdav_token as rotate_token, revoke_webdav_token as revoke_token,
     },
     TenantScopedConn,
 };
@@ -134,6 +134,31 @@ pub async fn create_webdav_token(
     Ok((StatusCode::CREATED, Json(response)))
 }
 
+#[utoipa::path(
+    post,
+    path = "/api/profile/webdav-tokens/{id}/regenerate",
+    params(("id" = Uuid, Path, description = "WebDAV token ID")),
+    responses((status = 200, description = "WebDAV token regenerated", body = WebdavTokenCreatedResponse)),
+    tag = "Profile"
+)]
+pub async fn regenerate_webdav_token(
+    TenantScopedConn {
+        mut conn,
+        tenant_id,
+        user_id,
+        ..
+    }: TenantScopedConn,
+    Path(token_id): Path<Uuid>,
+) -> AppResult<Json<WebdavTokenCreatedResponse>> {
+    let issued = rotate_token(&mut conn, token_id, user_id, Some(tenant_id))?;
+    let response = WebdavTokenCreatedResponse {
+        token: issued.token,
+        token_info: webdav_token_to_response(issued.record),
+    };
+
+    Ok(Json(response))
+}
+
 #[utoipa::path(
     delete,
     path = "/api/profile/webdav-tokens/{id}",
@@ -208,6 +233,7 @@ fn parse_timestamp(value: &str) -> AppResult<NaiveDateTime> {
     paths(
         crate::routes::profile::list_webdav_tokens,
         crate::routes::profile::create_webdav_token,
+        crate::routes::profile::regenerate_webdav_token,
         crate::routes::profile::delete_webdav_token,
         crate::routes::profile::list_passkeys,
         crate::routes::profile::delete_passkey

backend/src/routes/webdav/mod.rs

@@ -21,8 +21,7 @@ use crate::error::{AppError, AppResult};
 use crate::models::{Document, DocumentVersion, Folder, User};
 use crate::schema::{
     document_versions::dsl as document_versions_dsl, documents::dsl as documents_dsl,
-    folders::dsl as folders_dsl, user_memberships::dsl as memberships_dsl,
-    users::dsl as users_dsl,
+    folders::dsl as folders_dsl, user_memberships::dsl as memberships_dsl, users::dsl as users_dsl,
 };
 use crate::state::AppState;
 use crate::tenants::{apply_tenant_guc, apply_user_guc, clear_user_guc};

backend/src/tenants.rs

@@ -149,7 +149,7 @@ pub fn clear_tenant_context(conn: &mut PgConnection) -> AppResult<()> {
             set_config('papercrate.tenant_id', '', false), \
             set_config('papercrate.user_id', '', false), \
             set_config('papercrate.refresh_token_hash', '', false), \
-            set_config('papercrate.webdav_token_prefix', '', false)"
+            set_config('papercrate.webdav_token_prefix', '', false)",
     )
     .execute(conn)
     .map(|_| ())

backend/src/workers/index.rs

@@ -90,23 +90,25 @@ impl JobHandler for IndexDocumentTextJob {
 
         let state_clone = state.clone();
         let tenant_id = job.tenant_id;
-        let context = match task::spawn_blocking(move || load_context(state_clone, tenant_id, payload)).await {
-            Ok(Ok(ctx)) => ctx,
-            Ok(Err(err)) => {
-                warn!(job_id = %job.id, error = %err, "index job will retry");
-                return JobExecution::Retry {
-                    delay: Duration::from_secs(30),
-                    error: err,
-                };
-            }
-            Err(join_err) => {
-                error!(job_id = %job.id, error = %join_err, "index task panicked");
-                return JobExecution::Retry {
-                    delay: Duration::from_secs(60),
-                    error: format!("worker panicked: {join_err}"),
-                };
-            }
-        };
+        let context =
+            match task::spawn_blocking(move || load_context(state_clone, tenant_id, payload)).await
+            {
+                Ok(Ok(ctx)) => ctx,
+                Ok(Err(err)) => {
+                    warn!(job_id = %job.id, error = %err, "index job will retry");
+                    return JobExecution::Retry {
+                        delay: Duration::from_secs(30),
+                        error: err,
+                    };
+                }
+                Err(join_err) => {
+                    error!(job_id = %job.id, error = %join_err, "index task panicked");
+                    return JobExecution::Retry {
+                        delay: Duration::from_secs(60),
+                        error: format!("worker panicked: {join_err}"),
+                    };
+                }
+            };
 
         if context.text_s3_key.is_none() {
             warn!(job_id = %job.id, "missing OCR text asset; failing indexing job");

backend/src/workers/ocr.rs

@@ -83,22 +83,22 @@ impl JobHandler for GenerateOcrTextJob {
         })
         .await
         {
-                Ok(Ok(ctx)) => ctx,
-                Ok(Err(err)) => {
-                    warn!(job_id = %job.id, error = %err, "ocr job will retry");
-                    return JobExecution::Retry {
-                        delay: Duration::from_secs(30),
-                        error: err,
-                    };
-                }
-                Err(join_err) => {
-                    error!(job_id = %job.id, error = %join_err, "ocr task panicked");
-                    return JobExecution::Retry {
-                        delay: Duration::from_secs(60),
-                        error: format!("worker panicked: {join_err}"),
-                    };
-                }
-            };
+            Ok(Ok(ctx)) => ctx,
+            Ok(Err(err)) => {
+                warn!(job_id = %job.id, error = %err, "ocr job will retry");
+                return JobExecution::Retry {
+                    delay: Duration::from_secs(30),
+                    error: err,
+                };
+            }
+            Err(join_err) => {
+                error!(job_id = %job.id, error = %join_err, "ocr task panicked");
+                return JobExecution::Retry {
+                    delay: Duration::from_secs(60),
+                    error: format!("worker panicked: {join_err}"),
+                };
+            }
+        };
 
         if context.skip {
             info!(job_id = %job.id, "ocr already present; skipping");
@@ -489,7 +489,11 @@ fn persist_ocr_metadata(
     Ok(())
 }
 
-fn enqueue_index_job(state: &AppState, tenant_id: Uuid, payload: &OcrPayload) -> Result<(), String> {
+fn enqueue_index_job(
+    state: &AppState,
+    tenant_id: Uuid,
+    payload: &OcrPayload,
+) -> Result<(), String> {
     let mut conn = state
         .db_for_tenant(tenant_id)
         .map_err(|err| format!("{err:?}"))?;

backend/src/workers/thumbnails.rs

@@ -82,22 +82,22 @@ impl JobHandler for GenerateThumbnailsJob {
         })
         .await
         {
-                Ok(Ok(ctx)) => ctx,
-                Ok(Err(err)) => {
-                    warn!(job_id = %job.id, error = %err, "thumbnail job will retry");
-                    return JobExecution::Retry {
-                        delay: Duration::from_secs(30),
-                        error: err,
-                    };
-                }
-                Err(join_err) => {
-                    error!(job_id = %job.id, error = %join_err, "thumbnail task panicked");
-                    return JobExecution::Retry {
-                        delay: Duration::from_secs(60),
-                        error: format!("worker panicked: {join_err}"),
-                    };
-                }
-            };
+            Ok(Ok(ctx)) => ctx,
+            Ok(Err(err)) => {
+                warn!(job_id = %job.id, error = %err, "thumbnail job will retry");
+                return JobExecution::Retry {
+                    delay: Duration::from_secs(30),
+                    error: err,
+                };
+            }
+            Err(join_err) => {
+                error!(job_id = %job.id, error = %join_err, "thumbnail task panicked");
+                return JobExecution::Retry {
+                    delay: Duration::from_secs(60),
+                    error: format!("worker panicked: {join_err}"),
+                };
+            }
+        };
 
         if initial.skip {
             info!(job_id = %job.id, "thumbnails already exist; skipping");
@@ -129,7 +129,13 @@ impl JobHandler for GenerateThumbnailsJob {
             let version_id = initial.version.id;
             let tenant_id = initial.tenant_id;
             match task::spawn_blocking(move || {
-                persist_document_page_count(state_clone, tenant_id, document_id, version_id, page_count)
+                persist_document_page_count(
+                    state_clone,
+                    tenant_id,
+                    document_id,
+                    version_id,
+                    page_count,
+                )
             })
             .await
             {