update rust deps

backend/src/auth/api_tokens.rs

@@ -1,11 +1,10 @@
 use argon2::{
-    password_hash::{PasswordHasher, SaltString},
+    password_hash::{rand_core::OsRng as PasswordHashOsRng, PasswordHasher, SaltString},
     Argon2,
 };
 use chrono::{NaiveDateTime, Utc};
 use diesel::prelude::*;
-use rand::rngs::OsRng;
-use rand::RngCore;
+use rand::{rngs::OsRng, TryRngCore};
 use uuid::Uuid;
 
 use crate::{
@@ -264,7 +263,8 @@ fn generate_secret() -> Result<String, AppError> {
 }
 
 fn hash_secret(secret: &str) -> Result<String, AppError> {
-    let salt = SaltString::generate(&mut OsRng);
+    let mut salt_rng = PasswordHashOsRng;
+    let salt = SaltString::generate(&mut salt_rng);
     let hash = Argon2::default()
         .hash_password(secret.as_bytes(), &salt)
         .map_err(|err| {

backend/src/auth/jwt.rs

@@ -2,11 +2,12 @@ use anyhow::Result;
 use chrono::{Duration, Utc};
 use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};
 use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
 use uuid::Uuid;
 
 use crate::config::AppConfig;
 
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, ToSchema)]
 #[serde(rename_all = "snake_case")]
 pub enum PrincipalKind {
     UserSession,

backend/src/auth/mod.rs

@@ -7,7 +7,7 @@ pub mod password;
 
 use std::sync::{Arc, Mutex};
 
-use axum::{async_trait, extract::FromRequestParts, http::request::Parts};
+use axum::{extract::FromRequestParts, http::request::Parts};
 use axum_extra::headers::{authorization::Bearer, Authorization};
 use axum_extra::TypedHeader;
 use serde::{Deserialize, Serialize};
@@ -52,56 +52,59 @@ pub struct AuthenticatedUser {
     pub capabilities: Vec<ApiCapability>,
 }
 
-#[async_trait]
 impl FromRequestParts<AppState> for AuthenticatedUser {
     type Rejection = AppError;
 
-    async fn from_request_parts(
-        parts: &mut Parts,
+    #[allow(refining_impl_trait)]
+    fn from_request_parts<'a>(
+        parts: &'a mut Parts,
         state: &AppState,
-    ) -> Result<Self, Self::Rejection> {
-        if let Some(user) = parts.extensions.get::<AuthenticatedUser>() {
-            return Ok(user.clone());
-        }
+    ) -> impl std::future::Future<Output = Result<Self, Self::Rejection>> + Send + 'a {
+        let state = state.clone();
+        async move {
+            if let Some(user) = parts.extensions.get::<AuthenticatedUser>() {
+                return Ok(user.clone());
+            }
 
-        let TypedHeader(Authorization(bearer)) =
-            TypedHeader::<Authorization<Bearer>>::from_request_parts(parts, state)
-                .await
+            let TypedHeader(Authorization(bearer)) =
+                TypedHeader::<Authorization<Bearer>>::from_request_parts(parts, &state)
+                    .await
+                    .map_err(|_| AppError::unauthorized())?;
+
+            let claims = state
+                .jwt
+                .verify_token(bearer.token())
                 .map_err(|_| AppError::unauthorized())?;
 
-        let claims = state
-            .jwt
-            .verify_token(bearer.token())
-            .map_err(|_| AppError::unauthorized())?;
+            let mut tenant_conn = state.db_for_tenant(claims.tenant_id)?;
+            let capability_set = load_capability_set(&mut tenant_conn, claims.capability_set_id)
+                .map_err(|_| AppError::unauthorized())?;
 
-        let mut tenant_conn = state.db_for_tenant(claims.tenant_id)?;
-        let capability_set = load_capability_set(&mut tenant_conn, claims.capability_set_id)
-            .map_err(|_| AppError::unauthorized())?;
+            if capability_set.cap_version != claims.cap_version {
+                return Err(AppError::unauthorized());
+            }
 
-        if capability_set.cap_version != claims.cap_version {
-            return Err(AppError::unauthorized());
+            let capabilities = load_capabilities_for_set(&mut tenant_conn, capability_set.id)
+                .map_err(|_| AppError::unauthorized())?;
+
+            let user = AuthenticatedUser {
+                user_id: claims.sub,
+                username: claims.username,
+                tenant_id: claims.tenant_id,
+                principal_kind: claims.principal_kind,
+                principal_id: claims.principal_id,
+                capability_set_id: claims.capability_set_id,
+                cap_version: claims.cap_version,
+                capabilities,
+            };
+
+            parts.extensions.insert(user.clone());
+            parts
+                .extensions
+                .insert(TenantConnectionHolder::new(tenant_conn));
+
+            Ok(user)
         }
-
-        let capabilities = load_capabilities_for_set(&mut tenant_conn, capability_set.id)
-            .map_err(|_| AppError::unauthorized())?;
-
-        let user = AuthenticatedUser {
-            user_id: claims.sub,
-            username: claims.username,
-            tenant_id: claims.tenant_id,
-            principal_kind: claims.principal_kind,
-            principal_id: claims.principal_id,
-            capability_set_id: claims.capability_set_id,
-            cap_version: claims.cap_version,
-            capabilities,
-        };
-
-        parts.extensions.insert(user.clone());
-        parts
-            .extensions
-            .insert(TenantConnectionHolder::new(tenant_conn));
-
-        Ok(user)
     }
 }
 
@@ -118,29 +121,32 @@ impl TenantScopedConn {
     }
 }
 
-#[async_trait]
 impl FromRequestParts<AppState> for TenantScopedConn {
     type Rejection = AppError;
 
-    async fn from_request_parts(
-        parts: &mut Parts,
+    #[allow(refining_impl_trait)]
+    fn from_request_parts<'a>(
+        parts: &'a mut Parts,
         state: &AppState,
-    ) -> Result<Self, Self::Rejection> {
-        let user = AuthenticatedUser::from_request_parts(parts, state).await?;
-        let tenant_id = user.tenant_id;
-        let conn = if let Some(holder) = parts.extensions.remove::<TenantConnectionHolder>() {
-            holder
-                .into_conn()
-                .ok_or_else(|| AppError::internal("tenant connection unavailable"))?
-        } else {
-            state.db_for_tenant(tenant_id)?
-        };
+    ) -> impl std::future::Future<Output = Result<Self, Self::Rejection>> + Send + 'a {
+        let state = state.clone();
+        async move {
+            let user = AuthenticatedUser::from_request_parts(parts, &state).await?;
+            let tenant_id = user.tenant_id;
+            let conn = if let Some(holder) = parts.extensions.remove::<TenantConnectionHolder>() {
+                holder
+                    .into_conn()
+                    .ok_or_else(|| AppError::internal("tenant connection unavailable"))?
+            } else {
+                state.db_for_tenant(tenant_id)?
+            };
 
-        Ok(Self {
-            conn,
-            tenant_id,
-            user_id: user.user_id,
-            user,
-        })
+            Ok(Self {
+                conn,
+                tenant_id,
+                user_id: user.user_id,
+                user,
+            })
+        }
     }
 }

backend/src/auth/password.rs

@@ -1,9 +1,11 @@
 use anyhow::{anyhow, Result};
 use argon2::{
-    password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
+    password_hash::{
+        rand_core::OsRng as PasswordHashOsRng, PasswordHash, PasswordHasher, PasswordVerifier,
+        SaltString,
+    },
     Argon2,
 };
-use rand::rngs::OsRng;
 
 pub fn verify_password(password: &str, password_hash: &str) -> Result<bool> {
     let parsed_hash = PasswordHash::new(password_hash).map_err(|err| anyhow!(err))?;
@@ -13,7 +15,8 @@ pub fn verify_password(password: &str, password_hash: &str) -> Result<bool> {
 }
 
 pub fn hash_password(password: &str) -> Result<String> {
-    let salt = SaltString::generate(&mut OsRng);
+    let mut rng = PasswordHashOsRng;
+    let salt = SaltString::generate(&mut rng);
     let hash = Argon2::default()
         .hash_password(password.as_bytes(), &salt)
         .map_err(|err| anyhow!(err))?;