v0.0.5

src/routes/auth.rs

@@ -30,7 +30,6 @@ pub async fn auth_policy(Extension(config): Extension<Arc<AppConfig>>) -> Json<A
     })
 }
 
-/// JSON body expected on `POST /api/auth/login`.
 #[derive(Deserialize)]
 pub struct LoginRequest {
     pub email: String,
@@ -41,7 +40,6 @@ pub struct LoginRequest {
 }
 
 fn same_site_policy(_config: &AppConfig) -> &'static str {
-    // RustBox UI and API are same-origin in RustBox, so Strict is always valid.
     "Strict"
 }
 
@@ -138,11 +136,6 @@ fn extract_session_cookies(headers: &axum::http::HeaderMap) -> Vec<(String, Stri
     sessions
 }
 
-/// `POST /api/auth/login`
-///
-/// Validates the user's credentials against the configured IMAP server.
-/// On success, creates a session, provisions the user's data directory,
-/// and returns session cookies.
 pub async fn login(
     Extension(store): Extension<Arc<SessionStore>>,
     Extension(config): Extension<Arc<AppConfig>>,
@@ -165,10 +158,6 @@ pub async fn login(
             .into_response();
     }
 
-    // Server endpoints are administrator-owned configuration.  The login
-    // request supplies only user credentials; per-request host overrides are
-    // intentionally ignored so credentials cannot be redirected to an
-    // arbitrary mail server.
     let Some(imap_host) = config
         .imap_host
         .clone()
@@ -402,10 +391,6 @@ pub async fn login(
     }
 }
 
-/// `GET /api/auth/session`
-///
-/// Returns the current user's session information. Requires authentication
-/// (the `auth_guard` middleware injects `SessionState` into extensions).
 pub async fn get_session(Extension(session): Extension<SessionState>) -> Response {
     (
         StatusCode::OK,
@@ -660,11 +645,6 @@ struct ActiveSessionResponse {
     client_name: String,
 }
 
-/// `GET /api/auth/sessions`
-///
-/// Lists all live RustBox sessions for the currently authenticated user across
-/// browser sessions. Session tokens and server connection data are never
-/// returned to the UI.
 pub async fn list_active_sessions(
     Extension(store): Extension<Arc<SessionStore>>,
     Extension(config): Extension<Arc<AppConfig>>,
@@ -695,7 +675,6 @@ pub async fn list_active_sessions(
     Json(serde_json::json!({ "sessions": sessions })).into_response()
 }
 
-/// `DELETE /api/auth/sessions/{id}` — revoke another active session.
 pub async fn revoke_active_session(
     Extension(store): Extension<Arc<SessionStore>>,
     Extension(session): Extension<SessionState>,
@@ -732,8 +711,6 @@ pub async fn revoke_active_session(
     }
 }
 
-/// `POST /api/auth/sessions/revoke-others` — keep the current session and
-/// revoke every other live session for the same RustBox user.
 pub async fn revoke_other_sessions(
     Extension(store): Extension<Arc<SessionStore>>,
     Extension(session): Extension<SessionState>,
@@ -742,10 +719,6 @@ pub async fn revoke_other_sessions(
     Json(serde_json::json!({ "status": "revoked", "count": revoked })).into_response()
 }
 
-/// `POST /api/auth/logout`
-///
-/// Removes the current session from the store and clears the session cookie.
-/// Requires authentication.
 pub async fn logout(
     Extension(store): Extension<Arc<SessionStore>>,
     Extension(config): Extension<Arc<AppConfig>>,