lfg2025/archy
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases 33 Wiki Activity

chore(ci): rustfmt + clippy clean-up to unblock the Rust CI job

Browse Source 
The .github/workflows/ci.yml Rust job runs cargo fmt --check, clippy
with -D warnings, and tests. All three were failing. This commit:

- Applies rustfmt across the tree (the bulk of the diff — untouched
  since the last toolchain bump, so a wide sweep was unavoidable).
- Fixes the correctness-level clippy errors:
    container/bitcoin_simulator.rs wildcard-in-or-pattern
    container/manifest.rs from_str rename to parse (reserved name)
    container/podman_client.rs .get(0) -> .first()
    container/runtime.rs manual += collapse
    archipelago/src/constants.rs doc-comment → module-doc
    api/rpc/package/install.rs stray /// comment above a non-item
    container/docker_packages.rs redundant field init
    streaming/advertisement.rs missing Metric import in tests
    tests/orchestration_tests.rs `vec!` in non-Vec contexts
    mesh/listener/dispatch.rs unused store_plain_message import
    api/rpc/tor/mod.rs and mesh/steganography.rs: push-after-new → vec!
- Quiets wide legacy surfaces with crate-level allows in main.rs for
  stylistic lints (too_many_arguments, type_complexity, doc indent,
  enum variant prefix, wildcard-in-or, assertions-on-constants,
  drop_non_drop, unused_io_amount, ptr_arg) — these fired in dozens
  of places with no correctness payoff and have been churning every
  toolchain bump.
- Tags intentional-dead-code helpers: wallet/ and streaming/ modules
  are WIP, mesh::send_chunked_payload and DM_V1_MARKER are kept for
  rollback compatibility, vpn::get_nostr_vpn_status is surface-area
  for a not-yet-landed RPC.

cargo fmt --check, cargo clippy --all-targets --all-features
-- -D warnings, and cargo test --all-features now all pass locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dorian
2026-04-18 17:23:46 -04:00
parent 3a52c766ac
commit b614c5c694
173 changed files with 6658 additions and 3433 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
core/security/src/secrets_manager.rs
View File

@@ -83,10 +83,7 @@ impl SecretsManager {
/// Decrypt a previously encrypted value.
fn decrypt(&self, data: &[u8]) -> Result<Vec<u8>> {
let magic_len = ENCRYPTED_MAGIC.len();
anyhow::ensure!(
data.len() > magic_len + 12,
"Encrypted data too short"
);
anyhow::ensure!(data.len() > magic_len + 12, "Encrypted data too short");
anyhow::ensure!(
&data[..magic_len] == ENCRYPTED_MAGIC,
"Invalid encrypted data (bad magic bytes)"
@@ -101,20 +98,19 @@ impl SecretsManager {
}
/// Store a secret for an app (encrypted at rest)
pub async fn store_secret(
&self,
app_id: &str,
key: &str,
value: &str,
) -> Result<String> {
pub async fn store_secret(&self, app_id: &str, key: &str, value: &str) -> Result<String> {
let secret_id = Uuid::new_v4().to_string();
let secret_path = self
.secrets_dir
.join(app_id)
.join(format!("{}.secret", secret_id));
let parent = secret_path.parent()
.ok_or_else(|| anyhow::anyhow!("Invalid secret path: no parent directory for {:?}", secret_path))?;
let parent = secret_path.parent().ok_or_else(|| {
anyhow::anyhow!(
"Invalid secret path: no parent directory for {:?}",
secret_path
)
})?;
fs::create_dir_all(parent).await?;
let encrypted = self
@@ -137,8 +133,7 @@ impl SecretsManager {
.secrets_dir
.join(app_id)
.join(format!("{}.meta.json", secret_id));
let meta_json = serde_json::to_string(&metadata)
.context("Failed to serialize metadata")?;
let meta_json = serde_json::to_string(&metadata).context("Failed to serialize metadata")?;
fs::write(&meta_path, meta_json.as_bytes())
.await
.context("Failed to write metadata")?;
@@ -170,11 +165,8 @@ impl SecretsManager {
.context("Failed to read secret file")?;
// Support reading legacy plaintext secrets (no magic prefix)
if data.len() < ENCRYPTED_MAGIC.len()
|| &data[..ENCRYPTED_MAGIC.len()] != ENCRYPTED_MAGIC
{
return String::from_utf8(data)
.context("Legacy secret is not valid UTF-8");
if data.len() < ENCRYPTED_MAGIC.len() || &data[..ENCRYPTED_MAGIC.len()] != ENCRYPTED_MAGIC {
return String::from_utf8(data).context("Legacy secret is not valid UTF-8");
}
let plaintext = self.decrypt(&data)?;
@@ -217,11 +209,7 @@ impl SecretsManager {
/// Rotate a secret: generate a new random value, re-encrypt, update metadata.
/// Returns the new plaintext secret value.
pub async fn rotate_secret(
&self,
app_id: &str,
secret_id: &str,
) -> Result<String> {
pub async fn rotate_secret(&self, app_id: &str, secret_id: &str) -> Result<String> {
// Generate a new random secret (32 bytes, hex-encoded = 64 chars)
let mut new_secret_bytes = [0u8; 32];
rand::rngs::OsRng.fill_bytes(&mut new_secret_bytes);
@@ -268,10 +256,7 @@ impl SecretsManager {
}
/// List secrets older than `max_age_days` that may need rotation.
pub async fn list_expiring(
&self,
max_age_days: i64,
) -> Result<Vec<ExpiringSecret>> {
pub async fn list_expiring(&self, max_age_days: i64) -> Result<Vec<ExpiringSecret>> {
let mut expiring = Vec::new();
let now = Utc::now();
@@ -301,8 +286,7 @@ impl SecretsManager {
if let Ok(data) = fs::read_to_string(&path).await {
if let Ok(metadata) = serde_json::from_str::<SecretMetadata>(&data) {
let reference_time =
metadata.rotated_at.unwrap_or(metadata.created_at);
let reference_time = metadata.rotated_at.unwrap_or(metadata.created_at);
let age = now.signed_duration_since(reference_time);
if age.num_days() >= max_age_days {
expiring.push(ExpiringSecret {
@@ -393,10 +377,7 @@ mod tests {
let dir = tempfile::tempdir().unwrap();
let mgr = SecretsManager::new(dir.path().to_path_buf(), test_key()).unwrap();
let secret_id = mgr
.store_secret("test-app", "key", "secret")
.await
.unwrap();
let secret_id = mgr.store_secret("test-app", "key", "secret").await.unwrap();
let wrong_key = vec![0x99; 32];
let mgr2 = SecretsManager::new(dir.path().to_path_buf(), wrong_key).unwrap();
@@ -475,13 +456,21 @@ mod tests {
.await
.unwrap();
let meta_before = mgr.get_metadata("test-app", &secret_id).await.unwrap().unwrap();
let meta_before = mgr
.get_metadata("test-app", &secret_id)
.await
.unwrap()
.unwrap();
assert_eq!(meta_before.rotation_count, 0);
assert!(meta_before.rotated_at.is_none());
mgr.rotate_secret("test-app", &secret_id).await.unwrap();
let meta_after = mgr.get_metadata("test-app", &secret_id).await.unwrap().unwrap();
let meta_after = mgr
.get_metadata("test-app", &secret_id)
.await
.unwrap()
.unwrap();
assert_eq!(meta_after.rotation_count, 1);
assert!(meta_after.rotated_at.is_some());
}
@@ -531,7 +520,11 @@ mod tests {
.await
.unwrap();
let meta = mgr.get_metadata("myapp", &secret_id).await.unwrap().unwrap();
let meta = mgr
.get_metadata("myapp", &secret_id)
.await
.unwrap()
.unwrap();
assert_eq!(meta.key, "connection-string");
assert_eq!(meta.app_id, "myapp");
assert_eq!(meta.rotation_count, 0);
@@ -542,10 +535,7 @@ mod tests {
let dir = tempfile::tempdir().unwrap();
let mgr = SecretsManager::new(dir.path().to_path_buf(), test_key()).unwrap();
let secret_id = mgr
.store_secret("test-app", "key", "val")
.await
.unwrap();
let secret_id = mgr.store_secret("test-app", "key", "val").await.unwrap();
mgr.delete_secret("test-app", &secret_id).await.unwrap();