fixes

src/queries.rs

@@ -28,8 +28,8 @@ pub const AUTH_FIND_CONFIRMATION_TOKEN: &str =
     "SELECT user_id, expires_at, used_at FROM account_confirmation_tokens WHERE token = ?";
 pub const AUTH_CONFIRM_USER: &str =
     "UPDATE users SET confirmed_at = ?, updated_at = ? WHERE id = ?";
-pub const AUTH_MARK_CONFIRMATION_TOKEN_USED: &str =
-    "UPDATE account_confirmation_tokens SET used_at = ? WHERE token = ?";
+pub const AUTH_CONSUME_CONFIRMATION_TOKEN: &str =
+    "UPDATE account_confirmation_tokens SET used_at = ? WHERE token = ? AND used_at IS NULL AND expires_at > ?";
 pub const AUTH_DELETE_RESET_TOKENS_BY_USER: &str =
     "DELETE FROM password_reset_tokens WHERE user_id = ?";
 pub const AUTH_INSERT_RESET_TOKEN: &str =
@@ -38,8 +38,8 @@ pub const AUTH_FIND_RESET_TOKEN: &str =
     "SELECT user_id, expires_at, used_at FROM password_reset_tokens WHERE token = ?";
 pub const AUTH_UPDATE_PASSWORD: &str =
     "UPDATE users SET password_hash = ?, updated_at = ? WHERE id = ?";
-pub const AUTH_MARK_RESET_TOKEN_USED: &str =
-    "UPDATE password_reset_tokens SET used_at = ? WHERE token = ?";
+pub const AUTH_CONSUME_RESET_TOKEN: &str =
+    "UPDATE password_reset_tokens SET used_at = ? WHERE token = ? AND used_at IS NULL AND expires_at > ?";
 pub const AUTH_DELETE_SESSIONS_BY_USER: &str = "DELETE FROM user_sessions WHERE user_id = ?";
 pub const AUTH_USER_BY_SESSION: &str = "SELECT u.id, u.nickname, u.email, u.password_hash, u.confirmed_at FROM user_sessions s JOIN users u ON u.id = s.user_id WHERE s.token = ? AND s.expires_at > ?";
 pub const AUTH_INSERT_SESSION: &str =
@@ -148,6 +148,8 @@ pub const Q036: &str = "SELECT id, filename, url, mime_type, size_bytes, created
 pub const Q037: &str = "UPDATE pad_files SET is_attached = ?, detached_at = ? WHERE id = ?";
 pub const Q038: &str = "SELECT id, filename, url, mime_type, size_bytes, created_at, is_attached, detached_at FROM note_files WHERE id = ? AND note_id = ?";
 pub const Q039: &str = "DELETE FROM note_files WHERE id = ? AND note_id = ?";
+pub const Q046: &str = "SELECT id, filename, url, mime_type, size_bytes, created_at, is_attached, detached_at FROM pad_files WHERE id = ? AND pad_id = ?";
+pub const Q047: &str = "DELETE FROM pad_files WHERE id = ? AND pad_id = ?";
 
 static POSTGRES_QUERIES: OnceLock<Mutex<HashMap<&'static str, &'static str>>> = OnceLock::new();