nils/papercrate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stuff

Browse Source
This commit is contained in:
nils
2025-10-29 00:53:59 +01:00
parent 4b18429945
commit 3bdca88144
14 changed files with 122 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/migrations/202512010110_drop_webdav_token_scopes/down.sql
+2
View File
@@ -0,0 +1,2 @@
ALTER TABLE webdav_tokens
ADD COLUMN scopes JSONB NOT NULL DEFAULT '["webdav"]'::jsonb;
backend/migrations/202512010110_drop_webdav_token_scopes/up.sql
+2
View File
@@ -0,0 +1,2 @@
ALTER TABLE webdav_tokens
DROP COLUMN IF EXISTS scopes;
backend/src/auth/webdav_tokens.rs
+1 -48
View File
@@ -6,7 +6,6 @@ use chrono::{NaiveDateTime, Utc};
use diesel::prelude::*;
use rand::rngs::OsRng;
use rand::RngCore;
use serde_json::json;
use uuid::Uuid;
use crate::{
@@ -16,7 +15,6 @@ use crate::{
state::PgPooledConnection,
};
const WEB_DAV_SCOPE: &str = "webdav";
const TOKEN_PREFIX_LENGTH: usize = 12;
const TOKEN_SECRET_LENGTH: usize = 32;
@@ -30,16 +28,11 @@ pub fn create_webdav_token(
user_id: Uuid,
tenant_id: Uuid,
label: Option<String>,
scopes: Option<Vec<String>>,
expires_at: Option<NaiveDateTime>,
) -> Result<IssuedWebdavToken, AppError> {
let raw_secret = generate_secret()?;
let token_prefix = raw_secret[..TOKEN_PREFIX_LENGTH].to_string();
let token_hash = hash_secret(&raw_secret)?;
let scopes_value = scopes
.map(|scopes| json!(scopes))
.unwrap_or_else(|| json!([WEB_DAV_SCOPE]));
let new_token = NewWebdavToken {
id: Uuid::new_v4(),
user_id,
@@ -47,7 +40,6 @@ pub fn create_webdav_token(
token_prefix,
token_hash,
label,
scopes: scopes_value,
expires_at,
};
@@ -112,7 +104,7 @@ pub fn find_active_token_by_secret(
let candidates = query.load::<WebdavToken>(conn)?;
for token in candidates {
if verify_token_secret(secret, &token.token_hash)? && token_allows_webdav(&token.scopes) {
if verify_token_secret(secret, &token.token_hash)? {
return Ok(Some(token));
}
}
@@ -168,28 +160,6 @@ fn hash_secret(secret: &str) -> Result<String, AppError> {
Ok(hash.to_string())
}
pub fn parse_scopes(scopes: &serde_json::Value) -> Vec<String> {
match scopes {
serde_json::Value::Array(values) => values
.iter()
.filter_map(|value| value.as_str().map(|s| s.to_string()))
.collect(),
serde_json::Value::String(value) => value
.split(',')
.map(|s| s.trim())
.filter(|s| !s.is_empty())
.map(|s| s.to_string())
.collect(),
_ => vec![],
}
}
pub fn token_allows_webdav(scopes: &serde_json::Value) -> bool {
parse_scopes(scopes)
.into_iter()
.any(|scope| scope == WEB_DAV_SCOPE)
}
fn _ensure_constants() {
assert!(TOKEN_PREFIX_LENGTH < TOKEN_SECRET_LENGTH * 2);
}
@@ -211,21 +181,4 @@ mod tests {
assert!(verify_token_secret(&secret, &hash).unwrap());
assert!(!verify_token_secret("wrong", &hash).unwrap());
}
#[test]
fn parse_scopes_handles_strings_and_arrays() {
let from_array = parse_scopes(&json!(["webdav", "other"]));
assert_eq!(from_array, vec!["webdav", "other"]);
let from_string = parse_scopes(&json!("webdav, other"));
assert_eq!(from_string, vec!["webdav", "other"]);
assert!(parse_scopes(&serde_json::Value::Null).is_empty());
}
#[test]
fn token_allows_webdav_matches_scope() {
assert!(token_allows_webdav(&json!(["webdav"])));
assert!(!token_allows_webdav(&json!(["api"])));
}
}
backend/src/documents/asset.rs
+13
View File
@@ -128,6 +128,19 @@ pub fn to_asset_object_response(
}
}
pub fn delete_asset(state: &AppState, tenant_id: Uuid, asset_id: Uuid) -> AppResult<()> {
let mut conn = state.db_for_tenant(tenant_id)?;
diesel::delete(
document_assets::table
.filter(document_assets::id.eq(asset_id))
.filter(document_assets::tenant_id.eq(tenant_id)),
)
.execute(&mut conn)?;
Ok(())
}
pub async fn load_asset_responses(
state: &AppState,
tenant_id: Uuid,
backend/src/models.rs
-2
View File
@@ -69,7 +69,6 @@ pub struct WebdavToken {
pub token_prefix: String,
pub token_hash: String,
pub label: Option<String>,
pub scopes: serde_json::Value,
pub created_at: NaiveDateTime,
pub last_used_at: Option<NaiveDateTime>,
pub expires_at: Option<NaiveDateTime>,
@@ -85,7 +84,6 @@ pub struct NewWebdavToken {
pub token_prefix: String,
pub token_hash: String,
pub label: Option<String>,
pub scopes: serde_json::Value,
pub expires_at: Option<NaiveDateTime>,
}
backend/src/openapi.rs
-1
View File
@@ -1050,7 +1050,6 @@ pub mod schemas {
pub tenant_id: Uuid,
#[schema(nullable)]
pub label: Option<String>,
pub scopes: Vec<String>,
pub created_at: String,
#[schema(nullable)]
pub last_used_at: Option<String>,
backend/src/routes/profile.rs
+1 -4
View File
@@ -5,7 +5,7 @@ use uuid::Uuid;
use crate::auth::{
webdav_tokens::{
create_webdav_token as issue_token, list_webdav_tokens as load_tokens, parse_scopes,
create_webdav_token as issue_token, list_webdav_tokens as load_tokens,
revoke_webdav_token as revoke_token,
},
TenantScopedConn,
@@ -19,7 +19,6 @@ pub struct WebdavTokenResponse {
pub id: Uuid,
pub tenant_id: Uuid,
pub label: Option<String>,
pub scopes: Vec<String>,
pub created_at: String,
pub last_used_at: Option<String>,
pub expires_at: Option<String>,
@@ -70,7 +69,6 @@ pub async fn create_webdav_token(
user_id,
tenant_id,
payload.label.clone(),
None,
expires_at,
)?;
@@ -97,7 +95,6 @@ fn webdav_token_to_response(token: WebdavToken) -> WebdavTokenResponse {
id: token.id,
tenant_id: token.tenant_id,
label: token.label,
scopes: parse_scopes(&token.scopes),
created_at: to_iso(token.created_at),
last_used_at: token.last_used_at.map(to_iso),
expires_at: token.expires_at.map(to_iso),
backend/src/schema.rs
-1
View File
@@ -191,7 +191,6 @@ diesel::table! {
token_prefix -> Text,
token_hash -> Text,
label -> Nullable<Text>,
scopes -> Jsonb,
created_at -> Timestamptz,
last_used_at -> Nullable<Timestamptz>,
expires_at -> Nullable<Timestamptz>,
backend/src/workers/ocr.rs
+19 -1
View File
@@ -18,6 +18,7 @@ use tracing::{error, info, warn};
use uuid::Uuid;
use crate::{
documents::asset::delete_asset,
jobs::{enqueue_job, JOB_GENERATE_OCR_TEXT, JOB_INDEX_DOCUMENT_TEXT},
models::{
Document, DocumentAsset, DocumentAssetObject, DocumentVersion, NewDocumentAsset,
@@ -133,12 +134,29 @@ impl JobHandler for GenerateOcrTextJob {
};
};
if context.existing_asset.is_some() {
if let Some(existing_asset) = &context.existing_asset {
for object in &context.existing_objects {
if let Err(err) = storage.delete_object(&object.s3_key).await {
warn!(job_id = %job.id, error = %err, s3_key = %object.s3_key, "failed to delete existing ocr asset object");
}
}
let tenant_id = context.document.tenant_id;
let asset_id = existing_asset.id;
let state_clone = state.clone();
match task::spawn_blocking(move || {
delete_asset(state_clone.as_ref(), tenant_id, asset_id)
})
.await
{
Ok(Ok(())) => {}
Ok(Err(err)) => {
warn!(job_id = %job.id, error = ?err, asset_id = %asset_id, "failed to remove ocr asset metadata after deletion");
}
Err(join_err) => {
warn!(job_id = %job.id, error = %join_err, asset_id = %asset_id, "failed to remove ocr asset metadata: task panicked");
}
}
}
let asset_id = Uuid::new_v4();
backend/src/workers/thumbnails.rs
+57 -2
View File
@@ -12,6 +12,7 @@ use tracing::{error, info, warn};
use uuid::Uuid;
use crate::{
documents::asset::delete_asset,
jobs::JOB_GENERATE_THUMBNAILS,
models::{
Document, DocumentAsset, DocumentAssetObject, DocumentVersion, NewDocumentAsset,
@@ -152,7 +153,7 @@ impl JobHandler for GenerateThumbnailsJob {
}
}
if initial.existing_preview.is_some() {
if let Some(existing_preview) = &initial.existing_preview {
for object in &initial.existing_preview_objects {
if let Err(err) = storage.delete_object(&object.s3_key).await {
warn!(
@@ -163,9 +164,36 @@ impl JobHandler for GenerateThumbnailsJob {
);
}
}
let tenant_id = initial.document.tenant_id;
let asset_id = existing_preview.id;
let state_clone = state.clone();
match task::spawn_blocking(move || {
delete_asset(state_clone.as_ref(), tenant_id, asset_id)
})
.await
{
Ok(Ok(())) => {}
Ok(Err(err)) => {
warn!(
job_id = %job.id,
error = ?err,
asset_id = %asset_id,
"failed to remove preview metadata after deletion"
);
}
Err(join_err) => {
warn!(
job_id = %job.id,
error = %join_err,
asset_id = %asset_id,
"failed to remove preview metadata: task panicked"
);
}
}
}
if initial.existing_thumbnail.is_some() {
if let Some(existing_thumbnail) = &initial.existing_thumbnail {
for object in &initial.existing_thumbnail_objects {
if let Err(err) = storage.delete_object(&object.s3_key).await {
warn!(
@@ -176,6 +204,33 @@ impl JobHandler for GenerateThumbnailsJob {
);
}
}
let tenant_id = initial.document.tenant_id;
let asset_id = existing_thumbnail.id;
let state_clone = state.clone();
match task::spawn_blocking(move || {
delete_asset(state_clone.as_ref(), tenant_id, asset_id)
})
.await
{
Ok(Ok(())) => {}
Ok(Err(err)) => {
warn!(
job_id = %job.id,
error = ?err,
asset_id = %asset_id,
"failed to remove thumbnail metadata after deletion"
);
}
Err(join_err) => {
warn!(
job_id = %job.id,
error = %join_err,
asset_id = %asset_id,
"failed to remove thumbnail metadata: task panicked"
);
}
}
}
let preview_asset_id = Uuid::new_v4();