0.34.6_repo_cleanup

src/auth/files/mod.rs

@@ -1,4 +1,3 @@
-//! Local filesystem authority. The process owner can initialize or recover the sole admin.
 use anyhow::{ensure, Context, Result};
 use fs2::FileExt;
 use rand::{rngs::SysRng, TryRng};
@@ -102,8 +101,6 @@ pub fn load_or_create_setup_token(dir: &Path) -> Result<String> {
     Ok(token)
 }
 
-/// Validate database/WAL paths before opening SQLite. The private parent directory is
-/// the local CLI authorization boundary; files owned by the same OS user are trusted.
 pub fn prepare_database(path: &Path) -> Result<()> {
     if !path.try_exists()? {
         private_options().create_new(true).open(path)?.sync_all()?;
@@ -134,4 +131,4 @@ pub fn prepare_database(path: &Path) -> Result<()> {
     Ok(())
 }
 #[cfg(test)]
-include!("files/tests.rs");
+include!("tests.rs");

src/auth/mod.rs

@@ -1,5 +1,3 @@
-//! Password authentication is confined to the control plane.
-//! Expensive Argon2 work runs on bounded blocking workers, not Tokio network workers.
 mod files;
 mod store;
 use crate::{db::Store, runtime::ApiError};
@@ -151,7 +149,6 @@ impl Auth {
         } else {
             None
         };
-        // Generate valid dummy work for unknown usernames. This happens only at startup.
         let dummy_hash = hash_password_offline(random_secret()).await?;
         Ok(Arc::new(Self {
             store,

src/auth/store.rs

@@ -1,4 +1,3 @@
-//! Transactional administrator operations. Login/reset races are guarded by generation CAS.
 use super::{now, random_secret, secret_hash, Session, SessionToken, SESSION_SECONDS};
 use crate::db::{audit_tx, Store};
 use anyhow::{ensure, Result};
@@ -35,17 +34,12 @@ impl Store {
         tx.commit().await?;
         Ok(true)
     }
-    /// One persisted global bucket for the single administration listener.
-    /// Fixed upper bound: 10 attempts per 60-second window, including successful attempts.
-    /// Unknown usernames use the same bucket and password work as known usernames.
     pub async fn consume_auth_attempt(&self, time: i64) -> Result<bool> {
         let changed = sqlx::query("UPDATE auth_throttle SET attempts = CASE WHEN window_start <= ? THEN 1 ELSE attempts + 1 END, window_start = CASE WHEN window_start <= ? THEN ? ELSE window_start END WHERE id = 1 AND (window_start <= ? OR attempts < 10)")
             .bind(time - 60).bind(time - 60).bind(time).bind(time - 60)
             .execute(&self.pool).await?;
         Ok(changed.rows_affected() == 1)
     }
-    /// The first UPDATE obtains SQLite's write lock and validates the credential generation.
-    /// A reset committed during password verification prevents insertion of a stale session.
     pub async fn create_session(
         &self,
         generation: i64,
@@ -115,7 +109,6 @@ impl Store {
                 .execute(&mut *tx)
                 .await?;
         }
-        // Independent caps avoid a local CLI burst evicting all browser sessions.
         let cap = if kind == "cli" { 8_i64 } else { 16_i64 };
         sqlx::query("DELETE FROM admin_sessions WHERE token_hash IN (SELECT token_hash FROM admin_sessions WHERE kind = ? ORDER BY created_at DESC, rowid DESC LIMIT -1 OFFSET ?)")
             .bind(kind).bind(cap - 1).execute(&mut *tx).await?;
@@ -150,12 +143,6 @@ impl Store {
             "browser session lifetime must be 7..30 days"
         );
         let hash = secret_hash(secret);
-        // A browser session is bounded by the currently configured lifetime. If the
-        // setting was increased while an older still-valid session exists, extend its
-        // absolute expiry from its original creation time without turning it into a
-        // sliding/immortal session. CLI capabilities keep the fixed expiry chosen
-        // when they are created (60 seconds for one-shot admin commands, longer
-        // for the bounded local live-log viewer).
         let row = sqlx::query("UPDATE admin_sessions SET last_seen = ?, expires_at = CASE WHEN kind = 'browser' THEN created_at + ? ELSE expires_at END WHERE token_hash = ? AND expires_at > ? AND (kind <> 'browser' OR created_at + ? > ?) AND generation = (SELECT generation FROM administrator WHERE id = 1) RETURNING csrf_token, expires_at, generation, (SELECT username FROM administrator WHERE id = 1) AS username")
             .bind(time)
             .bind(browser_lifetime)
@@ -215,8 +202,6 @@ impl Store {
         tx.commit().await?;
         Ok(())
     }
-    /// expected_generation protects browser password changes against simultaneous resets.
-    /// CLI passes the generation it read, so even two offline recoveries cannot silently win.
     pub async fn reset_admin_password(
         &self,
         hash: &str,