nils/papercrate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stuff

Browse Source
This commit is contained in:
nils
2025-10-29 00:53:59 +01:00
parent 4b18429945
commit 3bdca88144
14 changed files with 122 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/migrations/202512010110_drop_webdav_token_scopes/down.sql
+2
View File
@@ -0,0 +1,2 @@
ALTER TABLE webdav_tokens
ADD COLUMN scopes JSONB NOT NULL DEFAULT '["webdav"]'::jsonb;
backend/migrations/202512010110_drop_webdav_token_scopes/up.sql
+2
View File
@@ -0,0 +1,2 @@
ALTER TABLE webdav_tokens
DROP COLUMN IF EXISTS scopes;
backend/src/auth/webdav_tokens.rs
+1 -48
View File
@@ -6,7 +6,6 @@ use chrono::{NaiveDateTime, Utc};
use diesel::prelude::*;
use rand::rngs::OsRng;
use rand::RngCore;
use serde_json::json;
use uuid::Uuid;
use crate::{
@@ -16,7 +15,6 @@ use crate::{
state::PgPooledConnection,
};
const WEB_DAV_SCOPE: &str = "webdav";
const TOKEN_PREFIX_LENGTH: usize = 12;
const TOKEN_SECRET_LENGTH: usize = 32;
@@ -30,16 +28,11 @@ pub fn create_webdav_token(
user_id: Uuid,
tenant_id: Uuid,
label: Option<String>,
scopes: Option<Vec<String>>,
expires_at: Option<NaiveDateTime>,
) -> Result<IssuedWebdavToken, AppError> {
let raw_secret = generate_secret()?;
let token_prefix = raw_secret[..TOKEN_PREFIX_LENGTH].to_string();
let token_hash = hash_secret(&raw_secret)?;
let scopes_value = scopes
.map(|scopes| json!(scopes))
.unwrap_or_else(|| json!([WEB_DAV_SCOPE]));
let new_token = NewWebdavToken {
id: Uuid::new_v4(),
user_id,
@@ -47,7 +40,6 @@ pub fn create_webdav_token(
token_prefix,
token_hash,
label,
scopes: scopes_value,
expires_at,
};
@@ -112,7 +104,7 @@ pub fn find_active_token_by_secret(
let candidates = query.load::<WebdavToken>(conn)?;
for token in candidates {
if verify_token_secret(secret, &token.token_hash)? && token_allows_webdav(&token.scopes) {
if verify_token_secret(secret, &token.token_hash)? {
return Ok(Some(token));
}
}
@@ -168,28 +160,6 @@ fn hash_secret(secret: &str) -> Result<String, AppError> {
Ok(hash.to_string())
}
pub fn parse_scopes(scopes: &serde_json::Value) -> Vec<String> {
match scopes {
serde_json::Value::Array(values) => values
.iter()
.filter_map(|value| value.as_str().map(|s| s.to_string()))
.collect(),
serde_json::Value::String(value) => value
.split(',')
.map(|s| s.trim())
.filter(|s| !s.is_empty())
.map(|s| s.to_string())
.collect(),
_ => vec![],
}
}
pub fn token_allows_webdav(scopes: &serde_json::Value) -> bool {
parse_scopes(scopes)
.into_iter()
.any(|scope| scope == WEB_DAV_SCOPE)
}
fn _ensure_constants() {
assert!(TOKEN_PREFIX_LENGTH < TOKEN_SECRET_LENGTH * 2);
}
@@ -211,21 +181,4 @@ mod tests {
assert!(verify_token_secret(&secret, &hash).unwrap());
assert!(!verify_token_secret("wrong", &hash).unwrap());
}
#[test]
fn parse_scopes_handles_strings_and_arrays() {
let from_array = parse_scopes(&json!(["webdav", "other"]));
assert_eq!(from_array, vec!["webdav", "other"]);
let from_string = parse_scopes(&json!("webdav, other"));
assert_eq!(from_string, vec!["webdav", "other"]);
assert!(parse_scopes(&serde_json::Value::Null).is_empty());
}
#[test]
fn token_allows_webdav_matches_scope() {
assert!(token_allows_webdav(&json!(["webdav"])));
assert!(!token_allows_webdav(&json!(["api"])));
}
}
backend/src/documents/asset.rs
+13
View File
@@ -128,6 +128,19 @@ pub fn to_asset_object_response(
}
}
pub fn delete_asset(state: &AppState, tenant_id: Uuid, asset_id: Uuid) -> AppResult<()> {
let mut conn = state.db_for_tenant(tenant_id)?;
diesel::delete(
document_assets::table
.filter(document_assets::id.eq(asset_id))
.filter(document_assets::tenant_id.eq(tenant_id)),
)
.execute(&mut conn)?;
Ok(())
}
pub async fn load_asset_responses(
state: &AppState,
tenant_id: Uuid,
backend/src/models.rs
-2
View File
@@ -69,7 +69,6 @@ pub struct WebdavToken {
pub token_prefix: String,
pub token_hash: String,
pub label: Option<String>,
pub scopes: serde_json::Value,
pub created_at: NaiveDateTime,
pub last_used_at: Option<NaiveDateTime>,
pub expires_at: Option<NaiveDateTime>,
@@ -85,7 +84,6 @@ pub struct NewWebdavToken {
pub token_prefix: String,
pub token_hash: String,
pub label: Option<String>,
pub scopes: serde_json::Value,
pub expires_at: Option<NaiveDateTime>,
}
backend/src/openapi.rs
-1
View File
@@ -1050,7 +1050,6 @@ pub mod schemas {
pub tenant_id: Uuid,
#[schema(nullable)]
pub label: Option<String>,
pub scopes: Vec<String>,
pub created_at: String,
#[schema(nullable)]
pub last_used_at: Option<String>,
backend/src/routes/profile.rs
+1 -4
View File
@@ -5,7 +5,7 @@ use uuid::Uuid;
use crate::auth::{
webdav_tokens::{
create_webdav_token as issue_token, list_webdav_tokens as load_tokens, parse_scopes,
create_webdav_token as issue_token, list_webdav_tokens as load_tokens,
revoke_webdav_token as revoke_token,
},
TenantScopedConn,
@@ -19,7 +19,6 @@ pub struct WebdavTokenResponse {
pub id: Uuid,
pub tenant_id: Uuid,
pub label: Option<String>,
pub scopes: Vec<String>,
pub created_at: String,
pub last_used_at: Option<String>,
pub expires_at: Option<String>,
@@ -70,7 +69,6 @@ pub async fn create_webdav_token(
user_id,
tenant_id,
payload.label.clone(),
None,
expires_at,
)?;
@@ -97,7 +95,6 @@ fn webdav_token_to_response(token: WebdavToken) -> WebdavTokenResponse {
id: token.id,
tenant_id: token.tenant_id,
label: token.label,
scopes: parse_scopes(&token.scopes),
created_at: to_iso(token.created_at),
last_used_at: token.last_used_at.map(to_iso),
expires_at: token.expires_at.map(to_iso),
backend/src/schema.rs
-1
View File
@@ -191,7 +191,6 @@ diesel::table! {
token_prefix -> Text,
token_hash -> Text,
label -> Nullable<Text>,
scopes -> Jsonb,
created_at -> Timestamptz,
last_used_at -> Nullable<Timestamptz>,
expires_at -> Nullable<Timestamptz>,
backend/src/workers/ocr.rs
+19 -1
View File
@@ -18,6 +18,7 @@ use tracing::{error, info, warn};
use uuid::Uuid;
use crate::{
documents::asset::delete_asset,
jobs::{enqueue_job, JOB_GENERATE_OCR_TEXT, JOB_INDEX_DOCUMENT_TEXT},
models::{
Document, DocumentAsset, DocumentAssetObject, DocumentVersion, NewDocumentAsset,
@@ -133,12 +134,29 @@ impl JobHandler for GenerateOcrTextJob {
};
};
if context.existing_asset.is_some() {
if let Some(existing_asset) = &context.existing_asset {
for object in &context.existing_objects {
if let Err(err) = storage.delete_object(&object.s3_key).await {
warn!(job_id = %job.id, error = %err, s3_key = %object.s3_key, "failed to delete existing ocr asset object");
}
}
let tenant_id = context.document.tenant_id;
let asset_id = existing_asset.id;
let state_clone = state.clone();
match task::spawn_blocking(move || {
delete_asset(state_clone.as_ref(), tenant_id, asset_id)
})
.await
{
Ok(Ok(())) => {}
Ok(Err(err)) => {
warn!(job_id = %job.id, error = ?err, asset_id = %asset_id, "failed to remove ocr asset metadata after deletion");
}
Err(join_err) => {
warn!(job_id = %job.id, error = %join_err, asset_id = %asset_id, "failed to remove ocr asset metadata: task panicked");
}
}
}
let asset_id = Uuid::new_v4();
backend/src/workers/thumbnails.rs
+57 -2
View File
@@ -12,6 +12,7 @@ use tracing::{error, info, warn};
use uuid::Uuid;
use crate::{
documents::asset::delete_asset,
jobs::JOB_GENERATE_THUMBNAILS,
models::{
Document, DocumentAsset, DocumentAssetObject, DocumentVersion, NewDocumentAsset,
@@ -152,7 +153,7 @@ impl JobHandler for GenerateThumbnailsJob {
}
}
if initial.existing_preview.is_some() {
if let Some(existing_preview) = &initial.existing_preview {
for object in &initial.existing_preview_objects {
if let Err(err) = storage.delete_object(&object.s3_key).await {
warn!(
@@ -163,9 +164,36 @@ impl JobHandler for GenerateThumbnailsJob {
);
}
}
let tenant_id = initial.document.tenant_id;
let asset_id = existing_preview.id;
let state_clone = state.clone();
match task::spawn_blocking(move || {
delete_asset(state_clone.as_ref(), tenant_id, asset_id)
})
.await
{
Ok(Ok(())) => {}
Ok(Err(err)) => {
warn!(
job_id = %job.id,
error = ?err,
asset_id = %asset_id,
"failed to remove preview metadata after deletion"
);
}
Err(join_err) => {
warn!(
job_id = %job.id,
error = %join_err,
asset_id = %asset_id,
"failed to remove preview metadata: task panicked"
);
}
}
}
if initial.existing_thumbnail.is_some() {
if let Some(existing_thumbnail) = &initial.existing_thumbnail {
for object in &initial.existing_thumbnail_objects {
if let Err(err) = storage.delete_object(&object.s3_key).await {
warn!(
@@ -176,6 +204,33 @@ impl JobHandler for GenerateThumbnailsJob {
);
}
}
let tenant_id = initial.document.tenant_id;
let asset_id = existing_thumbnail.id;
let state_clone = state.clone();
match task::spawn_blocking(move || {
delete_asset(state_clone.as_ref(), tenant_id, asset_id)
})
.await
{
Ok(Ok(())) => {}
Ok(Err(err)) => {
warn!(
job_id = %job.id,
error = ?err,
asset_id = %asset_id,
"failed to remove thumbnail metadata after deletion"
);
}
Err(join_err) => {
warn!(
job_id = %job.id,
error = %join_err,
asset_id = %asset_id,
"failed to remove thumbnail metadata: task panicked"
);
}
}
}
let preview_asset_id = Uuid::new_v4();
frontend/src/DesktopWorkspace.css
+2 -2
View File
@@ -205,8 +205,8 @@ body.skeuo-cursor-remove * {
.skeuo-item__card--empty {
background:
radial-gradient(circle at 28% 24%, rgba(255, 255, 255, 0.32), transparent 60%),
radial-gradient(circle at 72% 78%, rgba(0, 0, 0, 0.08), transparent 65%),
radial-gradient(circle at 28% 24%, color-mix(in oklch, white 32%, transparent), transparent 60%),
radial-gradient(circle at 72% 78%, color-mix(in oklch, black 8%, transparent), transparent 65%),
linear-gradient(135deg, #e6e1d6 0%, #d2cdc2 100%);
width: 100%;
height: 100%;
frontend/src/index.jsx
+2 -2
View File
@@ -1805,7 +1805,7 @@ const AppLayout = () => {
setDeletingWebdavTokenId(tokenId);
try {
await api.delete(`/profile/webdav-tokens/${tokenId}`);
setWebdavTokens((previous) => previous.filter((entry) => entry.id !== tokenId));
await refreshWebdavTokens();
setStatusMessage('WebDAV token revoked.', 'success');
return true;
} catch (error) {
@@ -1815,7 +1815,7 @@ const AppLayout = () => {
setDeletingWebdavTokenId(null);
}
},
[api, notifyApiError, setStatusMessage],
[api, refreshWebdavTokens, notifyApiError, setStatusMessage],
);
const dismissCreatedWebdavToken = useCallback(() => {
frontend/src/settings/SettingsModal.jsx
-5
View File
@@ -181,23 +181,18 @@ const SettingsModal = ({
<th scope="col">Created</th>
<th scope="col">Last used</th>
<th scope="col">Expires</th>
<th scope="col">Scopes</th>
<th scope="col">Actions</th>
</tr>
</thead>
<tbody>
{tokens.map((token) => {
const isRevoked = Boolean(token?.revoked_at);
const scopes = Array.isArray(token?.scopes)
? token.scopes.join(', ')
: '—';
return (
<tr key={token.id} className={isRevoked ? 'is-revoked' : undefined}>
<td>{token.label || '—'}</td>
<td>{formatDateTime(token.created_at)}</td>
<td>{formatDateTime(token.last_used_at)}</td>
<td>{formatDateTime(token.expires_at)}</td>
<td>{scopes || '—'}</td>
<td className="settings-table__actions">
{isRevoked ? (
<span className="settings-status">Revoked</span>
frontend/src/styles.css
+23 -23
View File
@@ -757,7 +757,7 @@ button.danger:hover:not([disabled]) {
.preview-workspace__metadata {
background: var(--surface-subtle);
padding: 1rem;
box-shadow: inset 0 0 0 1px rgba(0, 0, 0, 0.06);
box-shadow: inset 0 0 0 1px var(--outline-subtle);
font-size: 0.85rem;
overflow: auto;
max-height: 40vh;
@@ -778,7 +778,7 @@ button.danger:hover:not([disabled]) {
flex: 1;
min-width: 0;
background: var(--surface-subtle);
box-shadow: inset 0 0 0 1px rgba(0, 0, 0, 0.06);
box-shadow: inset 0 0 0 1px var(--outline-subtle);
display: flex;
position: relative;
overflow: hidden;
@@ -975,8 +975,8 @@ button.danger:hover:not([disabled]) {
top: 50%;
left: 50%;
transform: translate(-50%, -50%);
color: #fff;
background: rgba(0, 0, 0, 0.65);
color: var(--on-accent);
background: var(--overlay-dark);
padding: 0.5rem 1rem;
border-radius: 999px;
font-size: 0.9rem;
@@ -1192,7 +1192,7 @@ button.danger:hover:not([disabled]) {
background: var(--surface);
border: 1px solid var(--border-muted, var(--border));
border-radius: 0.5rem;
box-shadow: 0 12px 28px rgba(15, 23, 42, 0.18);
box-shadow: 0 12px 28px var(--shadow-strong);
min-width: 220px;
z-index: 20;
overflow: hidden;
@@ -1313,7 +1313,7 @@ button.danger:hover:not([disabled]) {
.menu__logout:hover,
.menu__logout:focus-visible {
background: rgba(209, 67, 67, 0.12);
background: var(--surface-danger-subtle);
}
.sidebar__search {
@@ -1465,12 +1465,12 @@ button.danger:hover:not([disabled]) {
color: var(--fg);
transition: transform 0.15s ease, box-shadow 0.15s ease, border-color 0.15s ease,
opacity 0.12s ease;
box-shadow: 0 1px 2px rgba(15, 23, 42, 0.06);
box-shadow: 0 1px 2px var(--shadow-faint);
}
.sidebar-tag-pill:hover {
transform: none;
box-shadow: 0 2px 6px rgba(15, 23, 42, 0.16);
box-shadow: 0 2px 6px var(--shadow-pop);
border-color: var(--accent-soft);
}
@@ -1511,7 +1511,7 @@ button.danger:hover:not([disabled]) {
.sidebar-correspondent-item:hover {
background: var(--sidebar-hover-bg);
box-shadow: 0 1px 3px rgba(15, 23, 42, 0.08);
box-shadow: 0 1px 3px var(--shadow-soft);
color: var(--fg);
}
@@ -1521,8 +1521,8 @@ button.danger:hover:not([disabled]) {
}
.sidebar-correspondent-item.active {
background: var(--sidebar-active-bg, rgba(59, 130, 246, 0.18));
box-shadow: 0 0 0 1px var(--sidebar-active-bg, rgba(59, 130, 246, 0.24));
background: var(--sidebar-active-bg);
box-shadow: 0 0 0 1px var(--sidebar-active-pill-border);
color: var(--fg);
}
@@ -2015,7 +2015,7 @@ button.danger:hover:not([disabled]) {
.tag-chip--more {
background: transparent;
border-color: var(--border-strong, rgba(15, 23, 42, 0.24));
border-color: var(--border-strong);
color: var(--muted);
}
@@ -2126,7 +2126,7 @@ button.danger:hover:not([disabled]) {
padding: 0.75rem;
background: var(--surface-soft);
border-radius: 6px;
box-shadow: inset 0 1px 2px rgba(15, 23, 42, 0.05);
box-shadow: inset 0 1px 2px var(--shadow-faint);
}
.detail-ocr__content pre {
@@ -2144,7 +2144,7 @@ button.danger:hover:not([disabled]) {
height: 60vh;
background: var(--surface-subtle);
border-radius: 4px;
box-shadow: inset 0 1px 2px rgba(15, 23, 42, 0.05);
box-shadow: inset 0 1px 2px var(--shadow-faint);
}
.modal__body {
@@ -2357,15 +2357,15 @@ button.danger:hover:not([disabled]) {
height: 2.2em;
padding: 0.45em;
border-radius: 999px;
background: rgba(0, 0, 0, 0.55);
color: #fff;
background: var(--preview-nav-bg);
color: var(--preview-nav-fg);
cursor: pointer;
transition: background 0.15s ease, opacity 0.15s ease;
pointer-events: auto;
}
.preview-pane__nav-button:hover:not([disabled]) {
background: rgba(0, 0, 0, 0.75);
background: var(--preview-nav-bg-hover);
}
.preview-pane__nav-button:disabled {
@@ -2603,7 +2603,7 @@ form.inline {
}
.settings-modal__sidebar button.active {
background: var(--surface-soft, rgba(148, 163, 184, 0.18));
background: var(--surface-soft);
font-weight: 600;
}
@@ -2651,7 +2651,7 @@ form.inline {
padding: 0.45rem 0.6rem;
border: 1px solid var(--border);
border-radius: 0.35rem;
background: var(--surface-soft, rgba(148, 163, 184, 0.12));
background: var(--surface-soft);
color: inherit;
}
@@ -2704,14 +2704,14 @@ form.inline {
.settings-notice {
border: 1px solid var(--accent);
background: rgba(37, 99, 235, 0.08);
background: var(--accent-soft);
padding: 0.9rem 1rem;
border-radius: 0.5rem;
margin-bottom: 1rem;
}
.token-display {
background: rgba(15, 23, 42, 0.08);
background: var(--surface-ink-soft);
padding: 0.5rem 0.65rem;
border-radius: 0.35rem;
font-family: var(--font-mono);
@@ -2869,8 +2869,8 @@ form.inline {
}
.login-card__tenant-button:hover:not([disabled]) {
background: var(--surface-hover, rgba(255, 255, 255, 0.1));
border-color: var(--border-strong, var(--border));
background: var(--surface-hover);
border-color: var(--border-strong);
}
.login-card__tenant-button:disabled {